Protection of Genetic Information: An International Comparison

Transcription

1 Report to the Human Genetics Commission Protection of Genetic Information: An International Comparison Deborah Crosbie LL.B September 2000 Crown Copyright Financed by: Research & Development section of Department of Health

2 CONTENTS INDEX 1 EXECUTIVE SUMMARY 5 DNA DATA BANKS 9 AUSTRALIA 9 CANADA 15 USA 22 SWEDEN 24 SUMMARY 24 INSURANCE 26 AUSTRALIA 26 CANADA 31 USA 31 GERMANY 34 SWEDEN 34 THE NETHERLANDS 37 SUMMARY 38 EMPLOYMENT 40 AUSTRALIA 40 CANADA 41 USA 42 GERMANY 47 SWEDEN 47 THE NETHERLANDS 48 SUMMARY 49 DATA PROTECTION AND PRIVACY 51 AUSTRALIA 51 CANADA 59 USA 68 GERMANY 69 SWEDEN 74 THE NETHERLANDS 75 SUMMARY 78 FORENSICS 80 AUSTRALIA 80 CANADA 84 USA 84 GERMANY 85 SUMMARY 86 RESEARCH 88 AUSTRALIA 88 CANADA 93 USA 96 GERMANY 99 SWEDEN 100 SUMMARY 103

3 ADOPTION 104 USA 104 SUMMARY 109 INTERNATIONAL REGULATION 110 REFERENCES 122

4 INDEX DNA DATA BANKS 9 AUSTRALIA 9 Human Genetics Society of Australasia: Guidelines for Human DNA Banking 9 Australian Health Ethics Committee: Guidelines for Genetic Registers and Associated Genetic Material 10 The Genetic Privacy and Non-discrimination Bill CANADA 15 The DNA Identification Act Bill S-10: an Act to amend the National Defence Act, the DNA Identification Act and the Criminal Code 20 Canadian College of Medical Geneticists: Policy Statement on DNA Banking 21 USA 22 Federal 22 The DNA Identification Act State 23 The Department of Defence DNA Repository 24 SWEDEN 24 Swedish Medical Research Council: Research Ethics Guidelines for Using Biobanks 24 SUMMARY 24 INSURANCE 26 AUSTRALIA 26 The Genetic Privacy and Non-discrimination Bill Draft LISA Policy on Genetic Testing: Underwriting and Genetic Testing, CANADA 31 USA 31 Federal 31 The Health Insurance Portability and Accountability Act The Americans with Disabilities Act State 32 GERMANY 34 The German Society of Human Genetics: Position Paper 34 SWEDEN 34 Swedish Insurance Federation: Voluntary Code 36 THE NETHERLANDS 37 SUMMARY 38 EMPLOYMENT 40 AUSTRALIA 40 1

5 The Genetic Privacy and Non-discrimination Bill CANADA 41 USA 42 Federal 42 The Americans with Disabilities Act The Health Insurance and Portability Act State 45 GERMANY 47 The German Society of Human Genetics: Position Paper 47 The Federal Medical Council 47 SWEDEN 47 THE NETHERLANDS 48 The Medical Checks Act SUMMARY 49 DATA PROTECTION AND PRIVACY 51 AUSTRALIA 51 The Privacy Protection Act The Privacy Amendment Bill The Genetic Privacy and Non-discrimination Bill The Privacy Amendment (Private Sector) Bill The Human Genetics Society of Australaisia: Privacy Implications of Genetic Testing 58 CANADA 59 The Personal Information Protection and Electronic Documents Act Bill C The Personal Health Information Act 1997 (Manitoba) 65 USA 68 GERMANY 69 The German Society of Human Genetics: Position Paper 74 SWEDEN 74 Existing Regulation 74 The Individual Medical Records Act THE NETHERLANDS 75 The Personal Data Protection Act SUMMARY 78 FORENSICS 80 AUSTRALIA 80 The Crimes Amendment (Forensic Procedures) Act CANADA 84 The DNA Identification Act 1998 and Bill S USA 84 2

6 GERMANY 85 SUMMARY 86 RESEARCH 88 AUSTRALIA 88 Current Regulation 88 National Health and Medical Research Council: National Statement on Ethical Conduct in Research Involving Humans 88 National Health and Medical Research Council: Ethical Aspects of Human Genetic Testing: an Information Paper 90 The Genetic Privacy and Non-discrimination Bill CANADA 93 Research Councils of Canada: Ethical Conduct for Research Involving Humans 93 Natural Sciences and Engineering Research Council of Canada: Human Genetic Research 95 USA 96 Code of Federal Regulations: Protection of Human Subjects 96 The National Bioethics Advisory Committee: Research Involving Human Biological Materials: Ethical Issues and Policy Guidance 98 GERMANY 99 Existing Regulation 99 The German Society of Human Genetics: Position Paper 99 SWEDEN 100 Existing Regulation 100 The Act Concerning Use of Gene Technology on Human Beings Swedish Medical Research Council: Research Ethics Guidelines For Using Biobanks 101 SUMMARY 103 ADOPTION 104 USA 104 American Society of Human Genetics: Report on Genetics and Adoption: Points to Consider 104 ASHG/ACMG Report: Points to Consider: Ethical, Legal, and Psychosocial Implications of Genetic Testing in Children and Adolescents 105 ASHG/ACMG Joint Statement: Genetic Testing in Adoption 105 SUMMARY 109 INTERNATIONAL REGULATION 110 HUGO Ethical, Legal, and Social Issues Committee: Statement on the Principled Conduct of Genetic Research 110 HUGO-ELSI Recommendations 110 HUGO Ethics Committee: Statement on DNA Sampling Control and Access 111 UNESCO: Universal Declaration on the Human Genome and Human Rights 112 European Convention on Human Rights and Biomedicine 115 3

7 European Data Protection 117 World Medical Association: Declaration of Helsinki 117 World Medical Association: Declaration on the Human Genome Project 118 World Health Organisation: Proposed International Guidelines on Ethical Issues in Medical Genetics and Genetic Services 119 4

8 EXECUTIVE SUMMARY 1. The Human Genetics Commission is considering issues around the storage, protection and use of personal genetic information. As part of this work, it commissioned this report, which aims to provide a comprehensive review of international law and regulation concerning the protection of genetic data in a wide range of contexts. The report also examines policy statements and guidelines issued by relevant organisations. The report covers: Australia, Canada, the United States, Germany, the Netherlands, and Sweden. However, it focuses on Australia and Canada as the most relevant comparators to the United Kingdom. The report considers the existing law and regulation in each of these countries under seven heads: DNA data banks, insurance, employment, data protection and privacy, forensics, research, and adoption. A section is also included on international protections. Notwithstanding that these categories are considered individually, it should be borne in mind that they are in fact inter-related, and ideally should be read together. 2. A clear distinction exists between legislation and policy that relates to criminal DNA databanks, and that which relates to clinical DNA databanks. The only exception is the Australian Genetic Privacy and Non-discrimination Bill 1998, which sets out basic requirements intended to ensure that all collections of DNA samples achieve a minimum standard. 3. As regards legislation relating to criminal DNA databanks, there is considerable variation in the terms and provisions of national legislation. For example, the categories of offences that will result in convicted offenders being entered into the DNA databank vary considerably. Similar differences are to be found as regards the use of information and samples held in the databanks. 4. There is generally more consensus in terms of policy relating to clinical DNA databanks, which are established primarily to meet the health care and future service needs of individuals, and their families, affected by genetic disorders. For example, all the policy regarding clinical databanks considered in this report provides that, as a general rule, the subjects written consent is required before the information contained in the databank can be disclosed to third parties. 1 Moreover, all the policies specify that certain information must be provided to individuals whose DNA is to be stored for clinical purposes before obtaining their consent. Some require that the individual be informed of the potential risks of storage, 2 and some also recommend that individuals should be informed of the possible consequences for family members. 3 All the recommendations stipulate that individuals whose DNA is to be stored in a clinical DNA databank should be informed of the purposes for which their sample is to be stored, and that participation is voluntary. 5. The issue of genetic discrimination in insurance is one of the most contentious, and, accordingly, it has attracted the attention of national legislators and policy-makers. Both the Netherlands and the USA 4 have enacted legislation that restricts genetic discrimination in insurance; Australia has attempted to; the Swedish State has signed an agreement with insurers governing their use of genetic information; and the German Bundestag has set up a Commission of Inquiry into Law and Ethics in Modern Medicine which will consider, amongst other things, genetic information. Notwithstanding the fact that these countries all agree that some form of regulation of insurers use of genetic information is required, the type and terms of the protections differ considerably. 1 Note, however, the exception provided by the Australian Health Ethics Committee where the information is sought under subpoena. 2 E.g. the Human Genetics Society of Australasia and the Canadian College of Medical Geneticists. 3 E.g. the Human Genetics Society of Australaisia and the Swedish Medical Research Council. 4 At a state level. 5

9 6. One explanation for some of the variation is that there are fundamental differences in terms of national provision of health care. For example, the Australian Medicare system provides universal health care to Australians, whereas the overwhelming majority of Americans rely on health insurance to meet their health care needs. Accordingly, US legislation focuses predominantly on prohibiting unfair discrimination with respect to health insurance, whereas the universal provision of health care under the Medicare scheme means that the discrimination issues are of most relevance with respect to life, disability, and employment insurance. 7. In terms of the restrictions provided by the various legislation, voluntary codes, and agreements, there is a general consensus that it is inappropriate to permit insurers to require applicants to undergo genetic testing as a condition of obtaining insurance, as this is incompatible with an individual s right not to know. There is less agreement, however, as to what use insurers should be able to make of existing genetic information. 8. Another key difference in the various regulation is the meaning given to genetic testing and genetic information. Some regulation construes genetic testing very narrowly, whereas other regulation defines it more inclusively. For example, the Swedish Agreement restricts the definition of genetic testing, for the purposes of the agreement, to presymptomatic, predictive, and susceptibility testing. In contrast, legislation enacted in South Carolina and Maine provide that a genetic test is any laboratory test for determining the presence or absence of genetic characteristics in an individual. Moreover, legislation such as the Medical Checks Act does not define either genetic testing or genetic information because such definitions are not relevant to the application of its provisions. Accordingly, it is not really possible, or indeed appropriate, to isolate the definitions of such terms for the purpose of comparison, as each must be read and understood in its context; that is, in terms of the aims and purpose of the legislation (or policy), and in light of the terms of other provisions. 9. Thus far, the only countries 5 with specifically enacted legislation to restrict employers use of genetic information are The Netherlands and the USA. The Australian Genetic Privacy and Non-discrimination Bill 1998 would have addressed the issue had it been enacted, but the Senate Legal and Constitutional Committee recommended that the Bill did not proceed, pending further consideration of the issues. In those countries that do not have specific regulations prohibiting or limiting employers access to, and use of, genetic information, existing anti-discrimination and privacy legislation may nevertheless provide individuals with some protection. For example, current protections in Australia derive from the existing general disability discrimination legislation. However, the Senate Legal and Constitutional Committee concluded that such legislation does not provide adequate protection for employees against improper or unfair use of genetic testing. The Committee was also of the opinion that allowing employers to require applicants or employees to submit to genetic testing would conflict with an individual s right not to know. Given that both Australia and the USA consider their existing protections to be inadequate, it is likely that these countries will enact specific legislation in the future. 10. Data protection and privacy is a very broad category and it should be remembered that the protections considered under this head also have implications with regard to the collection, storage, and use of genetic information by employers, insurers, researchers, and other individuals and organisations. 11. Nearly all the legislation considered does not relate specifically to the protection of personal genetic data; rather, it is general data protection legislation that may nevertheless 5 Of those studied in this report. 6

10 apply to the collection, storage, and use of personal genetic data. The one exception to this is the Manitoba Personal Health Information Act 1997, which explicitly states that the definition of health information includes genetic information. A further limited exception is the Dutch Personal Data Protection Act 2000, which contains a specific provision relating to the processing of data concerning inherited characteristics. Under this provision such data may only be processed with respect to the data subject, unless a serious medical interest prevails or the processing is necessary for the purpose of scientific research or statistics Not all of the legislation distinguishes between health information and other individually identifying personal information. 7 Moreover, with the limited exception of the Dutch Personal Data Protection Act, none of the legislation distinguishes between genetic information and other health information. 8 Indeed, the Swedish Ministry of Health and Social Affairs has expressly stated that there is no need to distinguish between genetic and other medical data, because data obtained from a genetic examination is already protected by existing legislation regarding the confidentiality of medical records. 13. The provisions considered under the section on Forensics relate very closely to the provisions considered in relation to criminal DNA databanks, and, ideally, the two should be considered in conjunction. 14. There are considerable differences in the scope and terms of the forensic procedures legislation considered in this report. Firstly, the Australian Crimes Amendment (Forensic Procedures) Act 1998 is the only legislation that distinguishes between intimate and non-intimate forensic procedures. The significance of this distinction in terms of the Act relates primarily to the ordering of forensic procedures to which the suspect has not consented. Non-intimate procedures may be carried out without the suspect s consent on the order of a constable; whereas an order from a magistrate authorising the carrying out of the procedure must be obtained before an intimate procedure can be carried out on a suspect who has not consented. The Act specifically provides, however, that a court order must be obtained to authorise the carrying out of any forensic procedure on a minor or person who lacks the capacity to consent. 15. Other differences are to be found in terms of the types of procedures that may be authorised. For example, the Canadian Criminal Code 9 authorises the taking of buccal swabs, blood samples, and hairs, including the root sheath, whereas the Australian legislation specifically provides that the Act does not authorise the taking of a hair by removing the root. Moreover, the German Code of Criminal Procedure authorises the taking of blood and other bodily intrusions. 16. The various legislation also contains different provisions regarding the use of force to enable a procedure to be carried out. At one extreme, the Canadian legislation provides that as much force as is necessary may be used for the purpose of carrying out the procedure. In contrast, the German legislation states that the use of direct force must be authorised by a special court order. 17. Research is an area that is generally self-regulated by national health and medical research councils. 10 There is a general consensus as to the ethical requirements of research involving human beings and, specifically, human genetics research. 6 In which case: the research must serve the public interest; the processing must be necessary for the research concerned; it must be impossible, or would involve a disproportionate effort, to ask the individual for express consent; and sufficient guarantees must be provided to ensure that the data subject s privacy is not adversely affected to a disproportionate extent. 7 See the German Federal Data Protection Act Note that the Manitoba Personal Health Information Act 1997 explicitly states that health information includes genetic information. 9 See Canadian DNA Identification Act 1998 para 1.36 and following 10 Note, however, the Swedish Act Concerning Use of Gene Technology on Human Beings

11 18. All the policy statements provide that: informed consent is usually required; the consent requirement may be waived in certain circumstances; 11 where the research subject is incapable of consenting to participation, consent should be sought from the subject s legal representative; an informed consent requires the individual to be provided with information regarding the purpose of the research, whether information obtained is to be coded, deidentified or identifiable, privacy protections, that the results of the research may be commercialised, the possible consequences of participating in the research, whether samples will be stored for future research purposes, and that participation is voluntary and consent may be withdrawn at any time; where the research is likely to produce results that relate to the individual s health status, appropriate genetic counselling should be available. 19. The key issue with regard to research into human genetics is not, therefore, what ethical standards should apply, but rather how these standards are applied in practice. On this issue, the position in the USA gives much cause for concern. In short, it is not sufficient to have ethical guidelines or codes of conduct governing human genetics research if these guidelines cannot be, or are not, enforced effectively. 20. Thus far, the USA is the only country to specifically address the issue of genetic testing in adoption. The issue first attracted the attention of the American Society of Human Genetics (ASHG) in the mid-1980s. The ASHG s early statements reflect the enthusiasm of the scientific world about the potential uses and benefits of the developing genetic testing technology. Thus, in its 1986 report, the ASHG considered whether the collection of genetic information concerning adopted children and their parents should be required by law. 21. However, as the potential risks of genetic testing (particularly genetic discrimination and stigmatisation) became more widely recognised, the ASHG modified its approach. Accordingly, more recent statements recognise the need to distinguish between the types of genetic tests currently available, and the purpose of such tests. The ASHG considers that only genetic testing for preventable or treatable diseases, and testing for serious childhood diseases, should be viewed with unqualified approval. As regards other types of genetic testing, such as for adult-onset diseases or carrier status, the ASHG recommends that such testing is inappropriate and cannot be justified. 22. The American Society of Human Genetics issued a joint statement with the American College of Medical Geneticists in The statement considers the issue of genetic testing in adoption in terms of the interests of a number of parties, including the adoptee, the adoptive parents, the biological parents, and the adoption agency. Notwithstanding the interests of other parties, the adoptees interests should always prevail. Moreover, the ASHG/ACMG joint statement advises that caution must be exercised to avoid crafting an approach that is too broad in encouraging the collection of genetic information in the adoption process, which arguably their earlier statements did. 11 Generally, if the research entails minimal risk for the subjects, if the research requires the requirement to be waived, and if the research will not adversely affect the rights and welfare of the individual. Or, in cases where the individual has consented to the use of their genetic data in an earlier research project, and the subsequent project is directly related to the earlier project. Or, if the research involves de-identified or coded data. 8

12 DNA DATA BANKS 12 AUSTRALIA Human Genetics Society of Australasia: Guidelines for Human DNA Banking 1.1 In Australia and New Zealand, DNA is stored for various short and long term purposes by both clinical service groups and researchers. Towards the end of the 1980s, the Human Genetics Society of Australasia (HGSA) recognised that developments in human genetic testing meant it was likely that gene mutations for an increasing number of monogenic disorders would be identified, which in turn might lead to an increase in the number of established DNA service laboratories, including some in the private sector. Accordingly, the HGSA considered it appropriate to develop guidelines on DNA banking. 1.2 The HGSA Guidelines for Human DNA Banking were published in July The Guidelines are intended to set standards for DNA banking, taking account of the medicolegal and ethical environment in which clinical genetics is practised in Australia. They also aim to ensure that the possible future service needs of families are considered whenever DNA is stored. As well as addressing some legal and ethical issues of DNA Banking, the Guidelines contain extensive recommendations relating to scientific procedure and technique. 13 The latter will not be considered here. Service or Research 1.3 In light of the fact that most research involving gene mapping of serious disorders will ultimately acquire a service dimension, the Guidelines identify several obligations of researchers to the families they are studying. 1.4 Firstly, the relevant State clinical genetics unit should be notified that DNA is being stored, and proper documentation should be kept and made available to whomever will be providing the service needs of the family. Secondly, in the case of individuals with a limited life expectancy, there should be a clear policy about what proportion of a sample may be used for research and what proportion should be set aside for future service needs. Furthermore, it is particularly important that proper consideration is given to the future service needs of the family at the end of the research. Consent 1.5 In terms of policy on consent, the HGSA considers that the appropriateness of not obtaining formal consent prior to taking blood samples for DNA analysis and banking may vary according to the nature of the test. 14 For example, it may be appropriate not to obtain formal consent where DNA is collected for prenatal testing of recessively inherited disorders, e.g. cystic fibrosis. The rationale is that in such cases the purpose of the investigation is well appreciated by those involved, and the only people who are involved are the parents and a previously affected child. In contrast, where the disease being tested for is a dominant or X- linked disease, e.g. Huntington s disease, a policy of not obtaining formal consent may be problematic. This is because in these cases it will often be necessary to bank samples from extended family, some members of which are not as motivated towards testing and may not be fully aware of the results of being tested Note, it was not possible to obtain any information in English concerning DNA databanks in Germany or The Netherlands. 13 For example, optimum temperatures at which DNA should be stored, transported, etc. 14 The Human Genetics Society of Australasia (HGSA), Guidelines for Human DNA Banking, July 1990, p.4 (hereinafter HGSA). 15 HGSA, p.4. 9

13 1.6 Despite making this provisional distinction, the HGSA nevertheless recommends that there are advantages to both the individuals being tested and laboratories if written consent is obtained from individuals providing DNA for banking. The Guidelines identify a number of matters to be discussed with an individual prior to consent being given, including the uses to which the DNA will be put, the use of DNA samples to define the status of other family members, potential future diagnostic uses, and the confidentiality and storage guidelines of the bank. 16 Confidentiality 1.7 The general principle governing confidentiality is that the results of an individual s DNA tests will not be disclosed to third parties without the written consent of the individual to whom the information relates. 17 Taking account of this principle, each DNA bank will have to develop its own confidentiality guidelines, although the HGSA recommends that access to information stored at the bank should be limited to the minimum possible number of designated personnel, and that appropriate security measures should be adopted. The HGSA recommends that DNA banks have a carefully considered procedure for the disposal of DNA samples, bearing in mind that these samples may still be valuable for research purposes. 1.8 Finally, the HGSA considers that it should have a key role in developing a set of guidelines for the accreditation of DNA Diagnostic Laboratories. Australian Health Ethics Committee: Guidelines for Genetic Registers and Associated Genetic Material 1.9 In 1999, the Australian Health Ethics Committee (AHEC), a principal committee of the National Health and Medical Research Council (NHMRC), published its Guidelines for Genetic Registers and Associated Genetic Material. The Guidelines are intended to provide guidance to those intending to establish a genetic register, to Human Research Ethics Committees that are asked to approve the establishment of a genetic register, and/or to institutions and organisations in which a genetic register is to be established. The Guidelines cover all aspects of the establishment and operation of a genetic register and have been in effect since 1 January Characteristics of a Genetic Register 1.10 The Guidelines identify some key characteristics of genetic registers that distinguish them from other collections that contain genetic information. Firstly, genetic registers address heritable disorders, and each register will usually only address one disorder or a closely related group of disorders. Secondly, the staff of genetic registers contribute to the provision of health care to both affected and unaffected family members, either directly or through health professionals. In other words, the purpose of genetic registers is to provide an effective way of identifying members of families who are at an increased risk of developing an inherited disorder or of having affected children, specifically for the purpose of prevention Accordingly, the following are not considered to be genetic registers even though they contain genetic information: medical records kept by health professionals in private practice and by hospitals; records of research studies; 16 HGSA, p HGSA, p.5. 10

14 databases established purely for research purposes; statute-based public health surveillance data sets established to monitor and study the epidemiology of disorders in the community; 18 registers which do not deal with inherited disorders; the results of genetic tests, or collections of tissue such as blood spots used for newborn screening held by laboratories and bloodbanks; and data sets created to monitor the impact of health services in relation to inherited disorders. 19 Establishment of a Genetic Register 1.12 The Guidelines identify a number of administrative requirements for establishing a genetic register. These include a clear rationale for establishing the register, including how it will benefit registrants, sufficient resources to enable the register to function for the time required to achieve its aims, and a secure place to house the register. A further requirement is that there must be written ethical guidelines that address, inter alia, consent, confidentiality, and procedures for collection and storage of genetic information and material. Recruitment of Registrants 1.13 For the purpose of the Guidelines, a registrant is a person who has consented to identified information about him/herself being collected, stored and used for specified purposes by register staff. To be an eligible registrant, a person must either have the heritable disorder which is the focus of the register, be a blood relative of someone with the heritable disorder, or be a current or previous spouse/partner of a person with the heritable disorder (to assess the risk that a child of the relationship has inherited the disorder). 20 Individuals approached as potential registrants who do not wish to consent to participation should have their wishes respected The Guidelines also stipulate how potential registrants should be approached. Before seeking a person s consent to be registered, the register staff should explain to the person how they were identified as a potential registrant, the aims and structure of the register, and how it works. Further information to be provided to potential registrants includes written or videotaped information about the register, the identification of the professionals who will be involved in the registrant s care, explanation of the registrant s role in involving other family members, and general counselling. 21 Consent 1.15 The Guidelines state that in general, consent should be obtained before identified information about a person is included in a register. 22 If that person is unable to give consent, e.g. by reason of intellectual disability, then consent should be obtained from a proxy who can legally consent on the person s behalf. The registrant (or proxy) should be fully informed of the aims, structure and operation of the register, and consent should usually be given in writing. In particular, registrants should be informed that participation in the register is voluntary and that they may withdraw consent at any time or request to have 18 The National Health Information Management Group is developing guidelines on the operation of statute-based health data collections. 19 Australian Health Ethics Committee, Guidelines for Genetic Registers and Associated Genetic Material, pp.7-8 (hereinafter Guidelines). 20 Guidelines, p Guidelines, pp Guidelines, p

15 identified genetic information and material relating to themselves removed. Registrants should also be informed that although they will determine to whom information about them may and may not be given, register staff may nevertheless be required to disclose information about them, or release their genetic material, to a court, person, or organisation to whom disclosure is authorised or required by law. 23 Register staff must seek the additional consent of the registrant to invite nominated relatives to participate in the register or to include the registrant s children. Where staff wish to include information about, or genetic material from, deceased individuals, consent should be sought from their legal representative, unless it is impossible or intrusive to do so. Confidentiality 1.16 The Guidelines require the organisation responsible for the genetic register to develop written procedures to ensure the confidentiality of information and the privacy of registrants. The written procedures should address the issue of disclosure of information to the following: staff of the register; the registrant; blood relatives and the spouse of the registrant; health professionals and other registers; those with access to laboratory databases; researchers; others, including insurance companies, employers and financial organisations; and persons or organisations to which disclosure is required by law As regards register staff, the custodian of the register must ensure that staff understand their obligation to maintain confidentiality and privacy. As regards a registrant who wants to access information about himself, register staff should enquire as to the reason for the request so that the information sought by the registrant can be presented in the most helpful way In the case of researchers seeking to use information or genetic material held by a register, the registrant s consent should be obtained if the research requires contact with the individual. However, consent is not required if the research uses coded or de-identified information. In all instances, the results of research using genetic information or material from a register should be published in a form that does not permit identification of individuals. Moreover, all research using information contained in registers should comply with the NHMRC National Statement on Ethical Conduct in Research Involving Humans, 25 and be approved by both an HREC and the register s own advisory committee Disclosure to all other persons or organisations requires the written informed consent of the registrant. There are exceptions to this: one instance is where access to information held in a register is sought under subpoena, or by an organisation with a statutory right to such information that is relevant to their functions (e.g. the Department of Social Security and the Police). 26 If access to a registrant s information is sought in these circumstances, the registrant should be informed immediately. Another instance occurs where the registrant is unable to give consent; consent may in this case be given by a person or organisation legally entitled to do so. Contacting Family Members 1.20 The primary aim of genetic registers is to afford relatives of registrants the opportunity to obtain information about the disorder in question for the purpose of prevention. It will therefore be necessary to contact the relatives of registrants. The Guidelines identify several ethical considerations involved in contacting relatives Guidelines, p.18. See also below, para Guidelines, pp See below, para Guidelines, p Guidelines, pp

16 1.21 For example, respecting registrants privacy involves having their consent before disclosing the fact of their registration and any other information to relatives and, equally, accepting their refusal to consent to disclosure. Similarly, respecting relatives who are to be approached involves either having their consent to be informed, or respecting their refusal to be informed. The Guidelines also contain advice on how relatives should be approached once a registrant has consented to their involvement. 28 Security 1.22 It is the responsibility of the custodian of the genetic register to ensure that there are adequate security safeguards to protect register information from unauthorised access, use, modification, or disclosure. 29 The custodian should also be aware of relevant standards such as Australian Standard AS , Personal Privacy Protection in Health Care Information Systems. Amalgamation and Winding Up of Genetic Registers 1.23 When it is necessary to amalgamate or wind up a register, registrants should be contacted immediately. Where registers are to be amalgamated, registrants should have the opportunity to withdraw from the register. In both amalgamation and winding up, registrants should be entitled to request that their information be returned to them, forwarded to a chosen health care professional, or disposed of. In cases of winding up, the registrants views should be sought as to whether genetic material stored at the register should be disposed of or stored in an alternative repository. Where registrants wish their genetic material to be stored at an alternative repository, register staff have an obligation to try to find a suitable repository. 30 The Genetic Privacy and Non-discrimination Bill The Genetic Privacy and Non-discrimination Bill was introduced into the Australian Senate on 11 March 1998 by the Deputy Leader of the Australian Democrats. The Bill was subsequently referred to the Senate Legal and Constitutional Legislation Committee for inquiry. Before the final report of the committee could be tabled, the 1998 Federal election was called. After the election, the Bill was referred to the newly constituted committee, which obtained several extensions of time to report, to 31 March The committee recommended that the bill did not proceed, pending further examination of the issues Although the Bill does not contain specific provisions for DNA banks, it is drafted on the premise that regulating the collection of DNA samples is central to privacy protection, and that therefore the same rules should apply to all collections. 31 Thus, the Bill sets out some basic requirements to ensure that all collections achieve a minimum standard. The relevant provisions are contained in Part 3 of the Bill: Collection, storage and analysis of DNA samples. Collection of Samples 1.26 Clause 12 provides that, except as otherwise provided by law, a person may only collect a DNA sample from an individual for genetic analysis if they have obtained written authorisation from the individual 32 and provided the individual with specified information See Guidelines, pp Guidelines, p Guidelines, p Australian Democrats, Genetic Privacy and Non-discrimination Bill 1998: Additional Comments (March 1999), p In accordance with clause

17 including a specified notice of rights and assurances, 34 and if the sample is collected in accordance with the individual s authorisation. Storage of DNA Sample and Conduct of Genetic Analysis 1.27 Under clause 13, storage or genetic analysis of a DNA sample is only permitted if the individual from whom the sample derives has been issued with a notice of rights and assurances and has provided written authorisation, and if the storage or analysis is in accordance with the authorisation. Again, these provisions are subject to existing legislation that provides otherwise. Notice of Rights and Assurances 1.28 The notice of rights and assurances must be issued to the relevant individual prior to the collection, storage or analysis of the DNA sample. Clause 14 provides that the following information must be contained in the notice: the DNA sample will be used in accordance with the written authorisation; the individual has the right to order destruction of an identifiable sample at any time; the sample will be destroyed upon completion of the genetic test or analysis, unless the individual has specifically consented in writing to further use of the sample; the individual may specify a designated person authorised to make decisions regarding disposition of the sample after the death of the individual; the individual has the right to examine records containing genetic information, to obtain copies of the records, and to request that the records be amended; that researchers may only be granted access to a DNA sample as specified in the individual s written authorisation; that the collection, storage, and analysis of the DNA sample, and any information derived from such, are protected by this Act, and that an individual whose rights are violated may seek redress as provided for in this Act; and about the availability, or not, of optional genetic counselling. Information to be Provided to the Individual 1.29 Clause 15 details the information that must be communicated to the individual by the person collecting the sample, in language understandable to the individual, prior to the collection of a DNA sample. This includes informing the individual that consent is voluntary; explaining about the information genetic analysis is likely to provide and the implications of this information for both the individual and family members; identifying the way the genetic information derived from the analysis will be used; and that revocation of consent will not absolve the individual of responsibility for all relevant costs of the genetic analysis. Authorisation to Collect, Store and Analyse DNA Samples 1.30 Clause 16 sets out the criteria with which an individual s authorisation must comply for it to be valid. The authorisation must be by way of signed writing, dated on the day of the signature. Furthermore, the authorisation must state: 33 In accordance with clause In accordance with clause

18 the identity of the person authorised to collect the DNA sample; the tissue to be collected and the method of collection; whether the individual authorises the sample to be retained after the analysis is complete; and, all authorised uses of the sample The authorisation should also include provisions that allow the individual to consent to additional uses, e.g. research or commercial use of the DNA sample. The authorisation should be retained for the duration of the collection, analysis and storage of the sample, and a copy must be provided to the individual. The Senate Legal and Constitutional Legislation Committee 1.32 The Committee considered the Bill in its entirety and, accordingly, the report focuses on general privacy issues, particularly in relation to insurance, employment, and research, etc. The committee did, however, express some concerns about the provisions relating to the collection and storage of DNA samples; in particular, with regard to information contained in a collection of tissue samples originally collected for some other purpose. The committee used the example of Guthrie spots, blood samples taken from all babies born in Australia and stored on cards as part of newborn screening programs. The committee considered that these inadvertent DNA sample banks 35 indicate the need for appropriate controls over access to and use of the samples contained in such collections. After all, though the Bill contains detailed provisions governing the collection, storage, and analysis of new DNA samples, it is silent on the issue of access to, and use of, existing samples. CANADA The DNA Identification Act The DNA Identification Act received assent on 10 December 1998, although the Act is not actually in force at present The purpose of the Act is to establish a national DNA data bank which will be maintained by the Royal Canadian Mounted Police and used to assist law enforcement agencies in the investigation of serious crimes. The Act provides a legal framework to regulate the storage and, in some cases, the collection of DNA data and biological samples and, amongst other things, it amends the Criminal Code to expand the courts authority to order the collection of biological samples for testing In response to recommendations from various sources, the Standing Committee on Justice and Human Rights made several amendments to Bill C-3, which are indicated here by bold type. A second reading followed, and the Bill was passed, as amended by the Committee, on 29 September The DNA Identification Act has been the subject of considerable controversy. Privacy advocates have argued for the retention of DNA data only, because of concerns that stored biological samples would be more susceptible to improper use. However, the government appears to have accepted the argument that biological samples must be stored, since the speed of new technological developments could require future re-testing to ensure 35 Senate Legal and Constitutional Legislation Committee, Consideration of Provisions of the Genetic Privacy and Nondiscrimination Bill 1998, 31 March 1999, chp.4, p.3 (hereinafter The Committee) 15

19 the availability of compatible data. Further criticism of the proposed legislation has come from law enforcement groups who believe that samples for DNA testing should be taken at the time of the charge (in the same way that fingerprints and photos are). Otherwise, police fear that persons responsible for serious unsolved crimes would simply fail to appear on new charges if they knew that conviction could lead to DNA screening which could implicate them in an additional offence. Definitions and Principles 1.37 A designated offence is defined as a primary or secondary designated offence, within the meaning of section of the Criminal Code. 36 Section 3 provides that the Act will apply to persons alleged to have committed a designated offence, including an offence committed before the coming into force of the Act Section 4 recognises that the protection of society and the administration of justice are well served by the early detection, arrest and conviction of offenders. However, it is also recognised that to protect the privacy of individuals with respect to personal genetic data about themselves, safeguards must be placed on the use and communication of, and access to, DNA profiles and other information contained in the national DNA data bank, and, likewise, the use of, and access to, biological samples that are transmitted to the Commissioner for the purpose of DNA analysis. The National DNA Data Bank Section 5(1) authorises the establishing of a national DNA data bank for the purpose of criminal identification, consisting of a crime scene index and a convicted offenders index. The crime scene index shall contain DNA profiles derived from bodily substances found: at the scene of a designated offence; on or within the body of the victim; on anything worn/carried by the victim at the time of the designated offence; or on any other person or thing associated with the commission of a designated offence The convicted offenders index shall contain DNA profiles derived from bodily substances described in subsection (1) of the Criminal Code. 38 In addition, the data bank will contain information from which can be established (i) the case number of the investigation, in the case of a profile in the crime scene index; and (ii) the identity of the person from whose bodily substance the profile was derived, in the case of a profile in the convicted offenders index. 39 Access to data 1.41 Under section 6(1), the Commissioner of the Royal Canadian Mounted Police (RCMP) is responsible for receiving DNA profiles. Once received, the profile is compared with other DNA profiles in the bank, and information concerning matches, or any other 36 Note that s.15(1) and (2) of the DNA Identification Act 1998 amend s of the Criminal Code. See below, para The list is very extensive and includes hijacking, using explosives, sexual interference, criminal negligence, robbery, assault, arson, and torture. 37 DNA Identification Act 1998, s.5(3). 38 DNA Identification Act 1998, s.5(4). The bodily substances described in s (1) include hair, buccal swabs, and blood samples. 39 DNA Identification Act 1998, s.5(5). 16

20 information, except the DNA profile itself, is to be communicated to the relevant Canadian law enforcement agency or laboratory. Information as to whether a person s DNA profile is contained in the convicted offenders index may also be communicated to agencies that already have access to the existing automated criminal records data base maintained by the RCMP. Furthermore, subsections 6(3) and (4) permit data comparisons and information sharing with governments of foreign states, international organisations established by the governments of states, or institutions of any such government or international organisation, subject to the proviso in section 6(5) that any such communication is solely for the purposes of the investigation or prosecution of a criminal offence. Indeed, subsections 6(6) and (7) explicitly prohibit communication or use of a DNA sample, or other information referred to in subsection (1), other than for the purpose of the administration of the Act, although the Commissioner may release information contained in the DNA data bank to appropriate personnel for operation and maintenance purposes, or for training purposes Section 8 states that information in the crime scene index shall be permanently removed if the DNA profile derived from a victim of a designated offence that was the object of the investigation, or from a person who has been eliminated as a suspect from the relevant investigation. Storage of Personal Information 1.43 The Act stipulates that information in the convicted offenders index will be kept indefinitely, unless: in the case of information in relation to a person who has been convicted of a designated offence, the conviction is quashed and a final acquittal entered; in the case of information in relation to a person who has been discharged under section 730 of the Criminal Code, (i) one year has passed since the person was discharged absolutely (unless the person is convicted of another offence during that year), or (ii) three years have passed since the person was conditionally discharged (unless the person is convicted of another offence during that period), in which case access to the information in the convicted offenders index must be permanently removed without delay The Act provides separate time limits applicable to the storage of information in relation to a young person who has been found guilty under the Young Offenders Act. The information shall be permanently removed without delay if: in the case of information in relation to a young person found guilty of certain designated offences under s of the Criminal Code, including hijacking, using explosives, incest, criminal negligence, and arson, ten years have passed since all dispositions (sentences) in respect of the offence have been completed; in the case of information in relation to a young person found guilty of a designated offence, other than first degree or second degree murder, manslaughter, attempted murder, and aggravated sexual assault, five years have passed since all dispositions in respect of the offence have been completed; or 40 DNA Identification Act 1998, s DNA Identification Act 1998, s.9. 17

21 in the case of information in relation to a young person found guilty of a designated offence that is a summary conviction offence, three years have passed since all dispositions in respect of the offence have been completed. 42 Storage of Bodily Substances 1.45 Section 10 of the Act contains provisions relating to the storage of bodily substances from which the DNA profiles are derived. It provides that the Commissioner must store safely and securely appropriate portions for DNA analysis, and destroy without delay any remaining portions. DNA analysis of stored bodily substances may be justified if there have been significant technological advances since the last DNA profile was derived. The Commissioner may grant access to any person appropriate for the purpose of preserving the bodily substances, and use or transmission of bodily substances is restricted to the purpose of DNA analysis. The Commissioner has discretion, under subsection (6), to destroy any biological samples that he considers are no longer required for the purpose of DNA analysis Otherwise, the Commissioner has a duty to destroy the bodily substances of persons without delay if: in the case of a person convicted of a designated offence, the conviction is quashed and a final acquittal entered; in the case of a person who has been discharged under section 730 of the Criminal Code of a designated offence, (i) after the expiry of one year after the person is discharged absolutely, unless the person is convicted of another offence during that year, or (ii) after the expiry of three years after the person is discharged conditionally, unless the person is convicted during those three years of another offence As regards young persons found guilty under the Young Offenders Act, stored bodily substances must be destroyed without delay if: in the case of a young person found guilty of a primary or secondary designated offence, including hijacking, using explosives, incest, criminal negligence, and arson, ten years have passed since all dispositions made in respect of the offence have been completed; in the case of a young person found guilty of a designated offence other than first degree or second degree murder, manslaughter, attempted murder, and aggravated sexual assault, five years have passed since the completion of all dispositions made in respect of the offence; or in the case of a young person convicted of a designated offence that is a summary conviction offence, three years have passed since all dispositions made in respect of the offence have been completed In addition, subsection 10(8) makes clear that samples obtained from persons who have been pardoned must be kept separate and apart from other stored bodily substances, and not subjected to DNA analysis. 42 DNA Identification Act 1998, ss.9(2)(c), (d) and (e). Note, however, that Bill S-10, which received assent on 29 June 2000, repeals ss.9(2)(c), (d) and (e), See below, para DNA Identification Act 1998, s.10(7)(a) and (b). 44 DNA Identification Act 1998, s.10(7) (c), (d) and (e). Note that these sections are also repealed by Bill S-10. See below, para 1.64 and following. 18

22 Offences 1.49 Under section 11, every person who contravenes subsection 6(6) or (7), section 8, or subsection 10(3) or (5), is guilty of an offence. When prosecuted by indictment, the maximum penalty available is 2 years imprisonment. On summary conviction, the maximum penalty is imprisonment for up to 6 months or a fine of up to $2000 dollars, or both In order to ensure the confidentiality of DNA profiles and related information contained in the DNA data bank, section 14 amends Schedule II of the Access to Information Act to mandate the refusal of requests for disclosure of any such records. Consequential Amendments 1.51 The second part of the Act includes a series of amendments designed to streamline the existing DNA warrant scheme. For example, section 16 amends existing section of the Criminal Code to make clear that a warrant for taking biological samples from a suspect would allow any number of samples of one or more bodily substances to be taken by means of more than one investigative procedure. Other amendments would widen the scope of the courts powers by allowing DNA testing of certain offenders post-conviction Section 15(1) amends the definition of designated offence in section of the Criminal Code by creating a distinction between primary- and secondary- designated offences, for which the consequences following conviction differ. The list of primary designated offences will include predominantly violent and sexual offences, where it is likely that bodily substances may be lost or exchanged (e.g. murder, sexual assault). The list of secondary designated offences includes other serious offences, but of a type that are less likely to result in the loss or exchange of bodily substances (e.g. hijacking, failure to stop at scene of accident). The Standing Committee on Justice and Human Rights approved the addition of infanticide to the list of primary designated offences. A number of sexual offences relating to children, as well as dangerous operation of a motor vehicle and impaired driving where these cause bodily harm or death, were also added to the list of secondary designated offences. Collecting Biological Samples Following Conviction 1.53 Section 17 of the Act adds a new section to the Criminal Code allowing the courts to order samples to be taken for DNA analysis from specific offenders following conviction. The new section will provide that where an offender has been convicted of a primary designated offence, the court will be obliged to make such an order, unless satisfied by the offender that the impact on his/her privacy would be grossly disproportionate to the public interest to be achieved. Where the conviction is for a secondary offence, the court may exercise its discretion and make such an order if satisfied that it is in the best interests of the administration of justice to do so. In deciding whether to make a discretionary order, the court must consider the nature of the offence and the circumstances surrounding its commission and the impact the order would have on the person s privacy and security. The court must also give reasons for its decision. Proposed section creates a right of appeal from the court s decision for both the offender and the prosecutor Under proposed section , the courts may order samples to be taken for DNA forensic analysis from persons found guilty of an offence committed before the coming into force of the Act. The same criteria are used to determine whether such an order is appropriate as are used in the case of secondary designated offences. Again, a right of appeal is established by section

23 1.55 Proposed section prohibits court-ordered sampling upon conviction where the prosecutor advises that a DNA analysis is not required for the purposes of the DNA Identification Act. Similarly, court-ordered sampling is prohibited if the convicted offender consented to the entry of a DNA profile into the convicted offenders register derived from bodily substances previously provided either voluntarily or in execution of a warrant An order made by the court authorises the taking, from that person, for the purpose of forensic DNA analysis, of any number of samples of one or more bodily substances that is reasonably required for that purpose, by means of the investigative procedures described in subsection (1) of the Criminal Code. 45 The procedures described in subsection (1) include: the plucking of individual hairs from the person, including the root sheath; the taking of buccal swabs by swabbing the lips, tongue and inside cheeks of the mouth to collect epithelial cells; or the taking of blood by pricking the skin surface with a sterile lancet Furthermore, subsection (1)(e) authorises the peace officer and any other person under the direction of the peace officer to use as much force as is necessary for the purpose of executing the warrant. Previously Convicted Offenders 1.58 Proposed section allows a court order for the taking of bodily substances for DNA analysis from certain offenders convicted prior to the coming into force of Bill C-3. On ex parte application, such an order can be made with respect to anyone who has been declared a dangerous offender, or anyone convicted of more than one of a number of listed sexual offences and serving a sentence of not less than two years. The definition of sexual assault includes most sexual offences involving children. The Standing Committee approved amendments providing that offenders who had been convicted of more than one murder, committed at different times, could also be ordered to submit to DNA analysis. Bill S-10: an Act to amend the National Defence Act, the DNA Identification Act and the Criminal Code 1.59 Bill S-10 was introduced in 1999 and received assent on 29 June The substantive amendments made by Bill S-10 relate to the National Defence Act and provide for the operation of the DNA Identification Act 1998 in the military Clause 1 adds a new section to the National Defence Act which defines terms such as DNA profile and primary- and secondary- designated offences. Primary and secondary designated offences include those within the meaning of section of the Criminal Code, as amended by the DNA Identification Act. 46 In addition, Bill S-10 identifies several military-specific secondary designated offences, including mutiny with violence, striking a superior officer, and endangering a person on an aircraft Section 1 also authorises military judges, on ex parte application in the prescribed form, to issue warrants authorising the taking of any number of biological samples from a person subject to the Code of Service Discipline, for the purpose of DNA analysis. In line with 45 DNA Identification Act 1998, s.17(a). 46 See above, para Bill S-10, s.1(b). 20

24 the DNA Identification Act, if a person is found guilty of a primary designated offence, the court martial must make an order for the taking of bodily substances (unless satisfied that were the order made, the impact on the privacy and security of the person would be grossly disproportionate to the public interest in the early detection, arrest and conviction of offenders ). If a person is found guilty of a secondary designated offence, the court martial has discretion to make such an order, taking account of the nature of the offence and the circumstances surrounding its commission, any previous convictions by a service tribunal or civil court and the impact such an order would have on the privacy and security of the person. The court must give reasons for its decision As regards offences committed before the coming into force of the DNA Identification Act, the provisions in Bill S-10 mirror those that apply to civilians under the DNA Identification Act. 49 All results of forensic DNA analysis on bodily substances that are taken in execution of an order under the new sections , or of the National Defence Act shall be transmitted to the Commissioner of the Royal Canadian Mounted Police (RCMP) for entry in the convicted offenders index of the national DNA databank. Amendments to DNA Identification Act 1.63 The amendments made to the DNA Identification Act and the Criminal Code are largely consequential amendments. For example, the definition of designated offence in the DNA Identification Act will now also refer to designated offences within the meaning of the new section of the amended National Defence Act (i.e. the military-specific designated offences) The only substantive amendment is that clause 7(2) repeals subsection 9(2) paragraphs (c) to (e) of the DNA Identification Act (destruction of information relating to young offenders), and, similarly, paragraphs (c) to (e) of subsection 10(7) (destruction of bodily substances relating to young offenders). 50 These sections of the DNA Identification Act are replaced with the following provisions: Access to information in the convicted offenders index relating to a young person who has been found guilty of a designated offence under the Young Offenders Act shall be permanently removed without delay when the last part of the record in relation to the offence is required to be destroyed under subsection 45(2), 45.02(3) or 45.03(3) of the Young Offenders Act. However, section 9 of the DNA Identification Act will still apply to information in the convicted offenders index in relation to a young person s record to which section or subsection 45.02(2) of the Young Offenders Act applies. 51 Similarly, stored bodily substances of a young person found guilty of a designated offence under the Young Offenders Act must also be destroyed without delay, in accordance with the provisions above. 52 Canadian College of Medical Geneticists: Policy Statement on DNA Banking 1.65 The Canadian College of Medical Geneticists (CCMG) issued a policy statement concerning DNA banking in However, the guidelines are restricted to DNA banking in relation to medical genetic diagnostic services. Accordingly, the guidelines stipulate that a DNA bank is a facility that is entrusted to store DNA so that it will be preserved for future 48 See above, para See above, para See above, paras 1.44 and Bill S-10, s.7(2). 52 Bill S-10, s.7(2). 21

25 analysis, for the purpose of promoting the health and wellbeing of the depositor and his/her relatives and descendants. 53 Deposition of Samples 1.66 The CCMG state that a DNA bank should only accept biological samples in response to a request from a health care professional, who should ensure that each sample is accompanied by a consent form. The health care professional should also obtain a complete genetic history of the individual s family to determine whether DNA banking is desirable. Sample Retrieval 1.67 The DNA bank should ensure that it has the necessary systems in place to safeguard security and confidentiality. The data storage system should also be suitably protected against potential hazards such as fire and computer break down. The DNA bank should release appropriate amounts of a sample to recognised DNA diagnostic laboratories upon the written request of a health care professional directly involved with the care of the depositor. A copy of the individual s diagnostic report derived from the analysis of this sample should be sent to the DNA bank and kept in the depositor s file. 54 Consent 1.68 The CCMG policy statement contains a sample consent form, which should be signed by a prospective depositor. This consent form should also specify the policies, procedures, and conditions pertaining to the deposition of samples. For example, the consent form should specify: standards of storage: a minimum of two sites is recommended; duration of storage: 100 years, representing four generations, is recommended; disposition of storage: it is recommended that a copy of the consent form should be included in the depositor s will and provide that, upon termination of the storage agreement, the DNA sample is to be either destroyed or donated to a research institution; costs of storage; and risks associated with storage Finally, the CCMG advise that a voluntary procedure for certification of DNA banks should be established. USA Federal The DNA Identification Act The DNA Identification Act 1994 authorised the FBI to establish the Combined DNA Index System ( CODIS ). The databank is designed to track the whereabouts and movements of: persons convicted of a criminal offence against a victim who is a minor; 53 Canadian College of Medical Geneticists, Policy statement concerning DNA banking (1991), p Id., p.2. 22

26 persons convicted of a sexually violent offence; and persons considered to be a sexually violent predator. 55 The term sexually violent predator means a person who has been convicted of a sexually violent offence and who suffers from a mental abnormality or personality disorder that makes the person likely to engage in predatory sexual offences CODIS is a three-tiered computer system used to facilitate the exchange of DNA profile information across the nation. The three levels include local, state and national tiers, all of which contain DNA profiles, and which are intended to be flexible enough to meet the specific legislative needs of state and local enforcement agencies. 57 All DNA profiles originate at the local level, then flow to the state and national levels. The national tier of the CODIS network is a repository for DNA profiles submitted by participating states, and allows states to exchange DNA profiles and perform inter-state searches. 58 The DNA profiles are stored in three indices: convicted offenders, unknown suspects, and a population file use for statistical purposes At the beginning of 1999, the CODIS database contained approximately 230,000 convicted offender profiles. 59 Because all the CODIS DNA samples originate at the local level, it depends on the relevant state legislation as to whether the sample taken to be analysed is a blood sample or a saliva swab. State 1.73 As of June 1998, all fifty states have passed legislation to create state criminal DNA databanks. Generally, states cite the assistance of law enforcement in identification, detection, or exclusion of individuals under criminal investigation as the main purpose of the database legislation 60. Some states require designated offenders to provide a blood sample for testing 61 and others, alternatively, require a saliva swab The scope of convicted offenders included in DNA databases varies from state to state. Most statutes only require a DNA sample from persons convicted of sex offences and violent felonies, but other states have increased the legislative scope to include persons convicted of any felony. 63 State legislation also varies in terms of policy regarding the destruction of samples when convictions are overturned, and the use of samples and records for research purposes. Currently, twenty-nine states require petitioning before the sample will be destroyed, eighteen states authorise the use of records for forensic research, and five authorise the use of samples for forensic research On 1 March 1999, the US Attorney General, Janet Reno, asked the National Commission on the Future of DNA Evidence to assess the legality of collecting DNA samples from everyone arrested by the police, and of banking the individually identifying genetic information they contain for future law enforcement use DNA Identification Act, s.14072(b). 56 DNA Identification Act, s.14071(a)(3). 57 R, W. Schumacher, Expanding New York s DNA Database: The Future of Law Enforcement, 26 (1999) Fordham Urban L.J. 1635, f.n Id., p FBI Laboratory Forensic Science Systems Unit, 1998 CODIS DNA Laboratory Survey (Washington D.C. January 1999). 60 Id. 61 e.g. Oklahoma. 62 e.g. Arkansas. 63 See J. Kimmelman, The Promise and Perils of Criminal DNA Databanking (July 2000) 18 Nature Biotechnology Id. 65 See E, T. Juengst, I-DNA-fication, Personal Privacy, and Social Justice (1999) 75 Chicago-Kent L. Rev

27 The Department of Defence DNA Repository 1.76 In 1991, the US Department of Defence (DoD) established a policy of mandatory DNA collection from all service members for the purpose of identifying the remains of service members. The DoD implements this policy by collecting blood and saliva samples from military personnel preparing for operational deployment, as well as from personnel enlisting or re-enlisting in the armed forces. The DoD estimates that the DNA repository will contain the specimens of all military personnel by In 1995, two US marines challenged the DoD s mandatory DNA collection policy by bringing a civil suit in the District Court of Hawaii, 67 followed by an appeal to the Ninth Circuit, in 1997, when the District Court found against them. 68 The legal challenge was based primarily on the Fourth Amendment. However, because the marines were discharged from the Marine Corps prior to oral argument, and they had refused to provide samples to the DoD DNA repository, the Ninth Circuit vacated the judgement of the District Court and remanded the case with instructions to dismiss it as moot. 69 Accordingly, the door has been left open for similar challenges to be brought by military personnel who are enlisted and who have provided samples for the DNA repository For a detailed review of the Department of Defence s DNA repository policy, and the challenge brought by the marines, see: E. Reiter, The Department of Defence DNA Repository: Practical Analysis of the Government s Interest and the Potential for Genetic Discrimination (1999) 47 Buffalo Law Review 975. SWEDEN Swedish Medical Research Council: Research Ethics Guidelines for Using Biobanks 1.79 The Swedish Medical Research Council issued guidelines for research using biobanks in June As the guidelines focus specifically on the use of biobanks for research purposes, they are considered in full under the section on Research. 70 However the guidelines do contain some recommendations relating to the establishment and management of biobanks and, accordingly, should be noted here as well. SUMMARY 1.80 A clear distinction exists between legislation and policy that relates to criminal DNA databanks, and that which relates to clinical DNA databanks. The only exception is the Australian Genetic Privacy and Non-discrimination Bill 1998, which sets out basic requirements intended to ensure that all collections of DNA samples achieve a minimum standard As regards legislation relating to criminal DNA databanks, there is considerable variation in the terms and provisions of national legislation. For example, CODIS, the USA national criminal databank, comprises three indices: convicted offenders, unknown suspects, and a population file (used for statistical purposes). The Canadian criminal databank, however, comprises a convicted offender index, and a crime scene index. Moreover, the 66 E. Reiter, The Department of Defence DNA Repository: Practical Analysis of the Governments Interest and the Potential for Genetic Discrimination (1999) 47 Buffalo L. Rev. 975, p Mayfield v. Dalton, 901 F. Supp. 300 (D. Haw. 1995) 68 Mayfield v. Dalton, 109 F.3d 1423 (9 th Cir. 1997) 69 E. Reiter, The Department of Defence DNA Repository: Practical Analysis of the Governments Interest and the Potential for Genetic Discrimination (1999) 47 Buffalo L. Rev. 975, p See below, para 6.69 and following. 24

28 categories of offences that will result in convicted offenders being entered into the DNA databank also vary considerably. The US DNA Identification Act 1994 restricts the relevant offences to offences against minors and sexually violent offences. 71 In contrast, the Canadian DNA Identification Act 1998 provides a very extensive list of designated offences, including hijacking, using explosives, sexual offences, criminal negligence, murder, manslaughter, robbery, arson, and torture Similar differences are to be found as regards the use of information and samples held in the databanks. Canadian legislation states explicitly that such samples and information may only be disclosed pursuant to the purposes of the Act; that is, to assist law enforcement agencies in the detection and prevention of crime. In contrast, eighteen US states authorise the use of records stored in criminal DNA databanks for forensic research, and five states authorise the use of the samples themselves for forensic research. Furthermore, the Canadian Act provides specified time limits on the storage of information and samples relating to young offenders, whereas the US legislation does not One key similarity between the US and Canadian legislation is that both only authorise the collection and storage of samples from convicted offenders. However, whilst the Canadian Act requires samples to be destroyed automatically where the conviction is quashed and the person acquitted, twenty-nine US states require individuals to petition for the destruction of stored samples There is generally more consensus in terms of policy relating to clinical DNA databanks, which are established primarily to meet the health care and future service needs of individuals, and their families, affected by genetic disorders. For example, all the policy regarding clinical databanks considered in this report provides that, as a general rule, the subjects written consent is required before the information contained in the databank can be disclosed to third parties Nevertheless, there are some differences in some of the specific provisions regarding disclosure and use of stored samples and information. For example, the Swedish Medical Research Council recommends that stored samples may be used for future research without the individual s specific consent, provided that: the information is coded or deidentified; the new research project is similar to that to which the individual did consent; and obtaining consent would be impossible. By way of comparison, the Australian Genetic Privacy and Non-discrimination Bill 1998 provides that researchers may only be granted access to stored samples if the individual permits such disclosure in their written authorisation All the policies specify that certain information must be provided to individuals whose DNA is to be stored for clinical purposes before obtaining their consent. Some require that the individual be informed of the potential risks of storage, 73 and some also recommend that individuals should be informed of the possible consequences for family members. 74 All the recommendations stipulate that individuals whose DNA is to be stored in a clinical DNA databank should be informed of the purposes for which their sample is to be stored, and that participation is voluntary. 71 Although, note, that state criminal data bank legislation tends to be much more inclusive. 72 Note, however, the exception provided by the Australian Health Ethics Committee where the information is sought under subpoena. 73 E.g. the Human Genetics Society of Australasia and the Canadian College of Medical Geneticists. 74 E.g. the Human Genetics Society of Australaisia and the Swedish Medical Research Council. 25

29 INSURANCE AUSTRALIA 2.1 In Australia, universal health insurance is provided under the Medicare scheme, under which there is no place for genetic information in determining eligibility. 75 Similarly, private health insurance, which supplements this scheme, is regulated under a statutory scheme which prevents genetic information from being used to discriminate against individuals. 76 Therefore, the issues in relation to genetic information and insurance in Australia are most relevant to other forms of insurance, such as life-, disability-, trauma-, property-, or employment-, etc, insurance. 77 Although there is currently no evidence of insurance discrimination in Australia, it is acknowledged that it is possible At present, there is no Australian legislation that deals specifically with the issue of genetic testing and insurance. However, some existing legislation may nevertheless be applicable and, therefore, will be considered. Three major issues arise in relation to insurance: should insurers be permitted to require applicants to undergo genetic testing prior to entering into an insurance contract? should insurers be permitted to require applicants to disclose the results of existing tests prior to entering into an insurance contract? should insurers be permitted to discriminate on the basis of genetic information? 2.3 The current position in Australia will be considered in relation to each of these issues in turn. Genetic Tests as a Prerequisite 2.4 There is no legislation in Australia that expressly prohibits insurance companies from requiring insurance applicants to undergo genetic testing prior to entering into an insurance contract. However, the insurance industry itself does not support this approach. The Life, Investment and Superannuation Association of Australia (LISA), which has now become the Investment and Financial Services Association (IFSA), in its policy on genetic testing, 79 stated that: The psychological impact of such [genetic test] information may be devastating for some people It is possible that many individuals would prefer not to know their risk, particularly for diseases for which there is no prospect of prevention or cure and which have no implications for others. LISA therefore believes that it is inappropriate for insurance companies to request applicants for insurance to undergo genetic testing However, as some commentators have pointed out, 81 if an insurer were to require an applicant to undergo genetic testing, this would constitute a breach of the voluntary LISA code, but would not be subject to legal sanction. 75 See Health Insurance Act 1973 (Cth) and amendments. 76 See subsection 73(2A) of the National Health Act 1953 (Cth). 77 Australian Democrats, Genetic Privacy and Non-discrimination Bill 1998: Additional Comments (March 1999), p Id. 79 Underwriting and Genetic Testing Draft LISA Policy on Genetic Testing (June 1997). 80 Id., p.33, cited in The Committee, chp.4, p.11 (emphasis added). 81 See for example, David Keays, The Legal Implications of Genetic Testing: Insurance, Employment and Privacy, Jnl. of Law and Med. (1999) Vol 16, p

30 Access to Existing Genetic Information 2.6 Existing legislation in Australia allows insurers to take into account existing genetic information (as well as family medical history which might include genetic information from other family members). 82 The position is governed by the Insurance Contracts Act 1984 (Cth). Section 21(1) of the Act sets out the insured s duty of disclosure. The insured has a duty to disclose to the insurer, prior to entering into an insurance contract, every matter known to the insured, or that a reasonable person in the circumstances could be expected to know, relevant to the insurer s decision to accept the insurance risk and, if so, on what terms. The Act distinguishes between innocent and fraudulent non-disclosures in that only the latter may entitle an insurer to avoid the contract. 83 Thus, under the existing law, insureds are under a legal obligation to provide insurers with existing genetic test results and, correspondingly, insurers are legally entitled to require access to existing test results. 2.7 The insurance industry supports this position, arguing that effective underwriting depends upon accurate risk assessment: it is reasonable and fair for insurers to be able to request that all existing genetic test results be made available to the insurer for the purposes of classifying the risk associated with an individual Similarly, the LISA policy on genetic testing asserts that the process of risk classification should be free to evolve and reflect the current state of medical knowledge 85 Moreover, insurers have argued that the risk of adverse selection justifies requiring disclosure. 86 In its report on the Genetic Privacy and Non-discrimination Bill, the Senate Committee also noted that it has long been routine practice for insurers to require applicants for insurance to provide information about family histories, which itself is in the nature of existing genetic information However, the Research Group for the Study of the Legal and Ethical Implications of Human Genetic Research in Australia, in its paper on insurance, 88 has voiced several objections to the current legal position Firstly, it is argued that allowing insurers access to existing test results will ultimately lead to a reduction in the availability of insurance, as some individuals will be excluded on the basis of their genotype. Also, some insurers may simply refuse to accept all but the lowest risk applicants, thus increasing the burden on other insurance companies. The Research Group therefore considers that a ban on the use of genetic information would help ensure that all insurers take their fair share of higher risk insureds Secondly, the Research Group emphasises the fact that genetic information is extremely complex and of limited predictive value. Consequently, it is likely that test results will be misinterpreted Finally, a major concern is that if individuals are compelled to disclose the results of genetic tests, this will deter people from undertaking genetic tests for fear that they will be 82 Australian Democrats, Genetic Privacy and Non-discrimination Bill 1998: Additional Comments (March 1999), p See subsection 29(3) of the Insurance Contracts Act 1984, with respect to innocent non-disclosures. 84 Association of Superannuation Funds of Australia Limited, cited in The Committee, chp.4, p Underwriting and Genetic Testing Draft LISA Policy on Genetic Testing (June 1997), p.28, cited in The Committee, chp.4, p The Committee, chp.4, p Id. 88 Implications of the Human Genome Project for Australian Insurance Law, Dr Margaret Otlowski. 89 Id., p.25, cited in The Committee, chp.4, p Underwriting and Genetic Testing Draft LISA Policy on Genetic Testing (June 1997), p.27, cited in The Committee, chp.4, p

31 discriminated against. 91 This is particularly significant where early diagnosis of a condition, or predisposition to a condition, may have a role in treatment. Discrimination on the Basis of Genetic Information 2.13 At present, the only limitation on genetic discrimination by Australian insurers is that the insurer may not discriminate within the framework of existing federal and state antidiscrimination legislation. The most relevant piece of federal legislation is the Disability Discrimination Act 1992 (Cth) Section 24 of the Act specifies that a provider of services must not discriminate against a person on the grounds of that person s disability by refusing to provide those services, or by discriminating in the terms and conditions on which the services are made available. Discrimination is defined as treating or proposing to treat the aggrieved person less favourably than a person without the disability, in circumstances that are the same or are not materially different. 92 The definition of disability 93 is sufficiently broad for it to be likely that a genetic mutation could be described as a disability for the purposes of s.4 of the Act. 94 For example, the definition specifically includes a disability that presently exists, may exist in the future, or is imputed, that results in a malfunction, malformation or disfigurement of part of the body. 95 However, the Act contains an important exemption for insurers. Section 46 of the Disability Discrimination Act provides, in part: if (1) This Part does not render it unlawful for a person to discriminate against another person, on the ground of the other person s disability, by refusing to offer the person: (a) an annuity; or (b) a life insurance policy; or (c) a policy of insurance against accident or any other policy of insurance; or (d) membership of a superannuation or provident fund; or (e) membership of a superannuation or provident scheme; (f) the discrimination: (i) is based upon actuarial or statistical data on which it is reasonable for the first mentioned person to rely; and (ii) it is reasonable having regard to the matter of the data and other relevant factors; or (g) in a case where no such actuarial or statistical data is available and cannot reasonably be obtained the discrimination is reasonable having regard to any other relevant factors Accordingly, the effect of this provision is to allow insurers to discriminate against a person on the basis of their genetic information, if such discrimination is based on actuarial or statistical data on which it is reasonable for the insurer to rely, or, where there is no such 91 Underwriting and Genetic Testing Draft LISA Policy on Genetic Testing (June 1997), pp.30-32, cited in The Committee, chp.4, p.10. See also P.S. Harper, Genetic Testing, Life Insurance and Adverse Selection (1997) 352 Phil Trans R Soc Lond B, p Disability Discrimination Act 1992 (Cth), s.4, read in conjunction with s Disability Discrimination Act 1992 (Cth), s.4(1). 94 Australian Democrats, Genetic Privacy and Non-discrimination Bill 1998: Additional Comments (March 1999), p Note, however, that in the context of the Americans with Disabilities Act 1994, it has been argued that everyone carries deleterious genes and so everyone has a disability which makes existing legislation useless: see B. Lennox, Genetic Discrimination in Insurance and Employment: Spoiled Fruits of the Human Genome Project (1997) 23 University of Dayton Law Rev 189, p

32 data, then having regard to other relevant (but undefined) factors. Under subsection 46(2), the same grounds may be used to impose higher premiums or restrict conditions, etc. State legislation essentially reflects the Commonwealth position Furthermore, as the Senate and Constitutional Legislation Committee pointed out in its report, the complaints mechanisms available to individuals claiming discrimination in the provision of insurance, or mishandling of their private information, are limited. 97 Firstly, the principal role of the Life Insurance Complaints Service is to deal with complaints of existing policyholders, and so individuals alleging discrimination prior to entering into an insurance contract may not be able to seek redress from this service. Secondly, a decision of the High Court of Australia in means that, having obtained a Commission determination in relation to a discrimination claim, a complainant must now commence new legal proceedings in the Federal Court in order to enforce that determination. 99 Thus, any redress available pursuant to the Disability Discrimination Act 1992 (Cth) is also severely limited. The Genetic Privacy and Non-discrimination Bill Part 4 of the Genetic Privacy and Non-discrimination Bill explicitly prohibits genetic discrimination. Genetic Discrimination to be Unlawful 2.18 Clause 17 stipulates that genetic discrimination is unlawful. Genetic discrimination describes an act involving a distinction, exclusion, restriction, or preference based on genetic information which has the purpose or effect or nullifying or impairing the recognition, enjoyment or exercise of any human right or fundamental freedom in any field of public life. 100 Note that for the purposes of the Act, genetic information means: information from a DNA sample about genotype; or information from mutation analysis; or information about nucleotide and polypeptide sequence(s); or information about gene(s) or gene products However, subsection 17(3) restricts the application of subsection (1) in respect of insurance, except as provided in Part 4 of the Act. Discrimination by Insurers 2.20 Clause 19 contains the provisions that relate specifically to genetic discrimination in the context of insurance. Clause 19 specifies that an insurer may request, require, or use an individual s genetic information if such information already exists. However, insurers are prohibited from terminating, limiting, restricting, refusing to renew, or otherwise applying conditions to the coverage of an individual or family member under the policy or plan involved on the basis of any genetic information about a healthy individual or a healthy family member, or on the basis of a request for or receipt of genetic services. 102 The 96 See Anti-Discrimination Act 1977 (NSW), s.49k; Anti-Discrimination Act 1991 (Qld), ss.7, 72 and 74; Equal Opportunity Act 1984 (SA), ss.5(1), 85(a) and (b); Equal Opportunity Act 1995 (Vic), ss.6 and 7; Equal Opportunity Act 1984 (WA), ss.66t and 66ZR; Discrimination Act 1991 (ACT), s The Committee, chp.4, p Brandy v Human Rights and Equal Opportunity Commission and Ors (1995) 183 CLR The Committee, chp.4, p Genetic Privacy and Non-discrimination Bill 1998, s.17(1). 101 Genetic Privacy and Non-discrimination Bill 1998, s Genetic Privacy and Non-discrimination Bill 1998, s.19(a). 29

33 formulation of clause 19 is intended to ensure that the use of genetic information by insurers in any assessment involving a healthy person (and their family) is effectively excluded, whilst still enabling insurers to collect information that may be relevant to actuarial and statistical tables. 103 No attempt is made to define the term healthy Subsection 19(c) further prohibits insurers from requiring applicants for insurance, or an individual or family member who is being enrolled under an insurance policy, to submit to genetic analysis or questions about genetic information In formulating the Bill, the Australian Democrats rejected the approach adopted by some countries of allowing insurance companies the right to request genetic test results in large or unusual policies. The rationale for rejecting this approach is that, without relevant actuarial and statistical data, it leaves open the problem of having adequate information to make informed decisions about the incidence and validity of claims of insurance discrimination (and whether it is justified). The problem also remains of determining at what level a policy should be considered large, and of determining the effects of this approach on the commercial viability of the insurance industry. 104 The Senate Legal and Constitutional Committee 2.23 The Committee considered in detail the issues relating to the use of genetic information in insurance. It concluded that, in prohibiting discrimination by insurers, the Genetic Privacy and Non-discrimination Bill did not take into account the exemption for insurers contained in s.46(1) of the Disability Discrimination Act 1992, or the discretion in the Life Insurance Act 1995, which allows insurers to determine premium rates according to actuarial evidence. 105 In light of this conclusion, the Committee recommended that the issues arising from the use of genetic information by insurers required further consideration and consultation. The Committee also considered that whilst the draft LISA policy on genetic testing in insurance went some way to addressing privacy and discrimination concerns, the lack of sanctions for failure to adhere to the policy undermined its certainty. 106 Draft LISA Policy on Genetic Testing: Underwriting and Genetic Testing The Life, Investment, and Superannuation Association of Australia (LISA) developed a proposed code of conduct for the insurance industry on the use of genetic testing which was published in June The policy, of course, is not legally binding or enforceable. The main points of the code are that insurance companies: will not initiate any genetic tests on applicants for insurance; may request that existing test results be made available to the insurer for the purposes of classifying the risk; will ensure that the results of existing genetic tests are only obtained with the written consent of the individual concerned; will ensure that strict standards of confidentiality apply in the handling and storage of the results of genetic tests; will only use the results of genetic tests in the assessment of the insurance application of the individual on whom the test was conducted the results will not be used in the assessment of insurance applications of relatives of the tested individual; 103 Australian Democrats, Genetic Privacy and Non-discrimination Bill 1998: Additional Comments (March 1999), p Id., p The Committee, chp.4, p Id. 30

34 will not make the results of genetic tests available to third parties other than reinsurance companies that may be directly involved in assessing the risk. 107 CANADA 2.25 In Canada, the development and practice of genetic testing has taken place within a clinical research setting. Accordingly, the focus of Canadian legislation and policy has been the use of genetic testing and genetic information for research and forensic purposes. At present, there is no Canadian legislation either enacted or proposed that specifically addresses the issue of genetic testing by insurers. 108 However, given the rapid development of genetic testing technology, and the concern in other countries (particularly the USA) regarding the use of genetic information by in insurers, it seems highly likely that this issue will be addressed in the near future. Accordingly, developments in this field should be monitored closely. 109 USA 2.26 In the USA, the possibility of genetic information being used by insurers to discriminate against individuals with certain genotypes has been the cause of considerable public anxiety, particularly because most Americans rely on health insurance to meet their health care needs. Accordingly, proposed and enacted legislation at both federal and state level focuses almost exclusively on prohibiting genetic discrimination in health insurance. In the UK, on the other hand, it is the possibility of genetic discrimination against applicants for life insurance that has caused most concern. 110 Because of this fundamental difference, a detailed analysis of US legislation is not particularly instructive, nor indeed appropriate. However, a brief overview of the position in the USA may be of use, if only to highlight some of the different approaches legislators have taken. Federal The Health Insurance Portability and Accountability Act The most significant legislation enacted at a federal level is the Health Insurance Portability and Accountability Act 1996 (HIPAA), the only federal law that directly addresses the issue of genetic discrimination in insurance. HIPAA provides some protection from genetic discrimination, but several loopholes remain. Most significantly, HIPAA applies to employer-based and commercially issued group health insurance only. There is no similar law applying to private individuals seeking health insurance in the individual market. The Health Insurance and Portability Act: prohibits group health plans from using any health status related factor, including genetic information, as a basis for denying or limiting eligibility for coverage or for raising an individual s premiums; 107 Underwriting and Genetic Testing Draft LISA Policy on Genetic Testing (June 1997), cited in The Committee, chp.4, p Although legislation such as the DNA Identification Act (relating to the establishment of a criminal DNA database) provides that genetic information obtained pursuant to the Act may only be used for the purposes specified in the Act, i.e. to assist law enforcement agencies in the investigation of serious crime. See, also, the protections provided by the Personal Information Protection and Electronic Documents Act 2000, considered below, paras 4.52 and following 109 Attempts to contact Canadian Insurance regulatory bodies to determine whether any voluntary codes of practice address the issue of genetic information in insurance were unsuccessful. Thus, it is possible that such codes do exist. 110 The reason for the difference in emphasis is that health insurance is not essential in the UK because of the NHS, whereas life insurance is now effectively a pre-requisite for the purchasing of a property because it tends to be directly linked to a mortgage. 31

35 limits exclusions for pre-existing conditions in group health plans to 12 months and prohibits such exclusions if the individual has been covered previously for that condition for 12 months or more; states explicitly that genetic information in the absence of a current diagnosis of illness shall not be considered a pre-existing condition However, HIPAA does not: prohibit an insurer from denying coverage on the basis of genetic information to individuals seeking health insurance in the individual market; prohibit the use of genetic information as a basis for charging inflated premiums for health insurance, except in the case of group plans; limit the collection of genetic information by insurers; prohibit insurers from requiring an individual to take a genetic test; limit the disclosure of genetic information by insurers. 112 The Americans with Disabilities Act The Americans with Disabilities Act 1996 (ADA) was not enacted specifically to address the issue of genetic discrimination in insurance. However, it affects the insurance industry in that it allows differences in benefits or insurance only if the differences are based on actuarial data. 113 State 2.30 Insurance is historically a state-regulated area in the USA, 114 and this is reflected in the proliferation of bills enacted and introduced at state level which address the issue of the use of genetic information by insurers. Thirty-five states have now enacted legislation regarding genetic discrimination in insurance. In addition, over 100 bills were introduced in the 1999 state legislative session alone regarding genetic discrimination by insurers and/or genetic discrimination by employers Almost all the enacted legislation applies only to health insurance. However, there are some states that have adopted a more inclusive approach. For example, legislation in South Carolina 116 prohibits all insurers from discriminating on the basis of genetic information by terminating, restricting, limiting or otherwise applying conditions to coverage of any individual; cancelling or refusing to renew coverage; excluding from coverage; imposing a waiting period; or, establishing a differential in premium rates. 117 Genetic information is defined as information about genes, gene products, or genetic characteristics derived from an individual or a family member of the individual. A genetic characteristic is any scientifically or medically identifiable gene or chromosome, or alteration thereof, which is known to be a cause of a disease or disorder, or determined to be associated with a statistically increased risk of developing a disease or disorder. A genetic test includes a laboratory or other scientifically or medically accepted procedure for determining the presence or absence of genetic characteristics in an individual Id. 113 H, R. Davis, J, V. Mitrius, Recent Legislation on Genetics and Insurance, 37 Jurimetrics (1996) 69, p.71, fn Id.,p South Carolina (1998) S

36 2.32 Moreover, the South Carolina legislation explicitly prohibits the disclosure of genetic information to a third party without written informed consent, and the performance of a genetic test without informed consent. It also explicitly prohibits insurers from requiring a person to consent to disclosure of genetic information as a condition of obtaining insurance. Accordingly, the Act addresses the loopholes left by HIPAA, outlined above Another state to adopt comprehensive legislation is Maine. 118 It prohibits insurers from discriminating - on the basis of genetic information, the refusal to submit to a genetic test or make available the results of a genetic test, or on the basis that the individual or eligible dependent received a genetic test or genetic counselling - in the issuance, withholding, extension, renewal, fixing of premiums, or any other terms in the issuance or acceptance of insurance. Moreover, it explicitly prohibits life, disability and long-term care insurers from making or permitting any unfair discrimination against an individual in the application of genetic information or the results of a genetic test in the issuance, withholding, extension or renewal of any insurance policy for life-, credit life-, disability-, long-term care-, accidental injury-, specified disease-, hospital indemnity-, or credit accident- insurance, or an annuity For the purposes of the Act, unfair discrimination includes, but is not limited to, the application of the results of a genetic test in a manner that is not reasonably related to anticipated claims experience. A genetic test is a test for determining the presence or absence of an inherited genetic characteristic in an individual, including analyses of DNA, RNA, or mitochondrial DNA, and tests of chromosomes or proteins in order to identify a predisposing genetic condition. The definition of genetic information extends to information concerning genes, gene products or inherited characteristics that may be obtained from an individual or family member. Genetic characteristic has the same meaning as under the South Carolina Act An example of the more typical, and less inclusive, approach of state legislators is Colorado, 121 which only prohibits utilisation of information derived from genetic testing from being used to deny access to health care insurance. A genetic test is defined as any laboratory test of human DNA, RNA, or chromosomes that is used to identify the presence or absence of alterations in genetic material which are associated with disease or illness. Genetic testing is restricted to only such tests that are direct measures of such alterations rather than indirect manifestations thereof Similarly, Connecticut 122 legislation only applies to health insurers, although the scope of the protection is not quite as narrow as that provided under the Colorado Act. For example, it prohibits insurers from refusing to insure, refusing to continue to insure, or limiting the amount, extent or kind of coverage available to an individual because of genetic information. It also prohibits health insurers from charging an individual a higher premium for the same coverage because of genetic information. As well as the scope of the prohibitions being wider, the definition of genetic information is also more inclusive. It means information about genes, gene products, or inherited characteristics that may derive from an individual or family member Finally, at the very bottom of the spectrum in terms of protecting individuals from genetic discrimination by insurers, is Alabama. Legislation enacted in prohibits health 118 Maine (1998) SP 0384 An Act to Protect the Privacy of Genetic Information See above, para Colorado (1994) Title 10, Art.3, Part II: δ Connecticut (1997) H Alabama (1982) AL ST:

37 insurers from denying coverage because the applicant has sickle cell anaemia; and legislation enacted in prohibits health insurers from requiring genetic testing to determine a pre-disposition for cancer, either to determine insurability or to determine rates or benefits. For the purposes of this Act, a genetic test is a pre-symptomatic laboratory test which is generally accepted in the scientific and medical communities to determine the presence or absence of the genetic characteristics that cause or are associated with a risk of a disease or disorder. GERMANY 2.38 In Germany, there are no specific legal regulations on the use of genetic testing and genetic information by insurers. However, the Federal government recently announced that the legal and ethical impacts of biotechnology are key issues to be addressed in the following years, and encouraged national debate. As a starting point, the German Bundestag has set up a Commission of Inquiry into Law and Ethics in Modern Medicine which will consider, among other things, genetic information. The German Society of Human Genetics: Position Paper 2.39 In 1996, the German Society of Human Genetics (GfH) 125 published a position paper on genetic testing. Although the paper focuses primarily on the ethics of medical genetics, the paper does briefly address the issue of genetic testing in insurance The position paper is based on the principles of self-determination, basic human equality and confidentiality. Accordingly, the GfH consider that preservation of an individual s right to control access to information about him/herself (the informationelles Selbstbestimmungsrecht ) requires legislation that protects an individual from discrimination when seeking insurance, including health insurance The GfH also recommend that private and public institutions should not be allowed to demand predictive genetic testing as a prerequisite to providing certain services as this would be incompatible with an individual s right not to know. Because of the impact of genetic information, utilisation of genetic testing should only occur on a voluntary basis. 126 SWEDEN 2.42 It should be noted that in addition to the regulations described below, in 1999 the Swedish Parliament resolved on a communication from the Government stating its intention to appoint a parliamentary committee to consider how genetic integrity is to be taken into account in every sector of society During 1998 and early 1999, a working group of the Ministry of Health and Social Affairs, in which the Swedish Insurance Federation was represented, looked at the issue of genetic testing and insurance. In particular, the working group considered the likely consequences of a statutory ban on using results from genetic testing in insurance operations. The work culminated in the signing of an agreement between the Swedish State and the Swedish Insurance Federation on 31 May 1999, governing the use of genetic testing and genetic information by insurance companies. 127 The agreement aims to attain a 124 Alabama (1997) H Deutsche Gessellschaft fur Humangenetic e.v, Position Paper of the German Society of Human Genetics, (1996). 126 Position Paper of the German Society of Human Genetics (1996), p.a Agreement Between the Swedish State and the Swedish Insurance Federation Concerning Genetic Testing (May 1999) (hereinafter The Agreement). 34

38 reasonable balance between the interests of insurers in obtaining information and the public interest in maintaining genetic integrity The agreement applies to insurance companies that belong to the Swedish Insurance Federation and market either life or health insurance in Sweden. However, it does not apply to child insurance, occupational group life insurance or collectively agreed group health insurance The agreement entered into force on 1 July 1999 and applies up to and including 31 December Under section 8, the agreement is to be extended by two years at a time. However, the agreement may be cancelled by either party, if effected in writing at least 6 months before its period of validity expires. The State is entitled to cancel the agreement with immediate effect in the event of an insurance company disregarding what the Insurance Federation has undertaken to ensure under the terms of the agreement. Definition of Genetic Testing 2.46 For the purposes of the agreement, genetic testing means: genetic tests carried out prior to the appearance of symptoms; genetic tests carried out for predictive purposes; and genetic tests carried out in order to demonstrate or exclude the possibility of people being genetically predisposed to a hereditary disorder or disease that manifests itself only in subsequent generations. Genetic Tests as a Prerequisite 2.47 In accordance with section 3 of the agreement, the Swedish Insurance Federation undertakes to ensure that its members do not require insurance applicants to undergo genetic testing as a condition for taking out insurance, or for extending existing insurance contracts. Access to Existing Genetic Information 2.48 Section 4 of the agreement provides that the Insurance Federation undertakes to ensure that its members do not inquire as to whether the applicant or policy holder has undergone genetic testing, or request the results of any such tests. It also provides that members of the Insurance Federation are not permitted to take into account in their risk assessment any data from genetic testing or family particulars. Family particulars means information relating to the incidence of hereditary disorders or diseases among an applicant s relatives However, the section also provides that in certain specified circumstances, the general prohibition will not apply, including: if the sum insured that is due as a lump sum on the death of the insured exceeds 15 times the price base amount 129 under the National Insurance Act 1962; or if the sum insured that is due as a periodic survivor s pension or survivor s annuity on the death of the insured exceeds one price base amount a year; or 128 The Agreement, s The price base amount is a figure in SEK linked to price trends and adjusted annually. It is used for official social security purposes, e.g. calculating pensions. 35

39 if the sum insured that is due, if the insured falls ill, to be disbursed in the form of a periodic allowance exceeds one price base amount a year In terms of life insurance, the sum insured refers to the total sum insured for death risks for the insurance policies applied for and for policies already taken out. In health insurance, the sum insured refers to the total sum insured for health risks for the insurance policies applied for and policies already taken out. Thus, the exceptions also apply when policyholders apply to increase the scope of their insurance beyond the specified thresholds. Discrimination 2.51 The agreement also specifies that members of the Insurance Federation are prohibited, in the terms and conditions of their health and life insurance, from exempting any illness with respect to disbursement of insurance indemnity, except on the basis of symptombased assessment. 130 Other Provisions 2.52 Under the terms of the agreement, the Insurance Federation is required to set up a review board charged with issuing recommendations concerning reassessment in cases where insurance applicants are dissatisfied with the way an insurance company has dealt with genetic information. 131 A review board has existed since 1 July 1999 and, to date, no case has been referred for review The State assumes responsibility for ensuring that developments in medical and clinical genetics are continuously monitored and comprehensively analysed by a public body specially appointed for the purpose. Swedish Insurance Federation: Voluntary Code 2.54 The agreement reached between the Swedish State and the Swedish Insurance Federation in 1999 has, in principle, the same effect as the Insurance Federation s voluntary code, which has been in effect since The voluntary code is an agreement amongst members of the Insurance Federation selling life or sickness-benefit insurance to limit the use of genetic information in risk assessment. For the purpose of the agreement, genetic testing means a genetic diagnosis of inherited predispositions in the genes and chromosomes in those instances where the predisposition has not yet given rise to a sickness, 133 i.e. presymptomatic genetic testing Under this agreement, insurance companies may not require insurance applicants to undergo genetic testing in order to obtain an insurance policy, or extend an existing insurance policy. The agreement also sets a limit on the sum insured, below which insurers are not permitted to take into account the results of any genetic tests an applicant has already undergone. Accordingly, insurers may not consider existing genetic test results in connection with an insurance application (or an application to extend an existing policy) when the total risk exposure is less than: SEK 250,000 if the sum insured is to be paid as a lump sum upon the death of the insured, or SEK 15,000 per year if the sum insured is to be paid as annuity to the survivors upon the death of the insured; 130 The Agreement, s The Agreement, s Swedish Insurance Federation, Agreement on limiting the use of information derived from genetic testing during risk evaluation of life and sickness-benefit insurance (24 September 1997). 133 Id., p.2. 36

40 SEK 250,000 if the sum insured is to be paid as a lump sum when the insured becomes ill, or SEK 15,000 per year if periodic compensation is to be paid during the insured s illness. THE NETHERLANDS 2.56 On 5 July 1997, the Netherlands adopted the Medical Checks Act, 134 which contains provisions intended to strengthen the legal position of persons undergoing medical examinations in certain specified contexts. The Act applies to medical examinations in connection with, inter alia, a civil pension or life insurance contract, or a civil occupational disability insurance contract. The Medical Checks Act Definition of Medical Check 2.57 In the context of insurance, medical check encompasses both enquiries regarding the health of a subject and medical tests, made or performed in connection with the establishment or amendment of either a civil pension or life insurance contract, or a civil occupational disability insurance contract. 136 Restriction of Medical Checks 2.58 Under section 3 of the Act, the enquiries made, or the test performed, as part of the medical check must not unreasonably infringe the subject s privacy. Specifically, a medical check must not include a test that entails a disproportionate risk for the subject as against the usefulness of the test to the commissioning party. The example is given of a test intended to provide information regarding the likelihood of the subject developing a serious condition which is untreatable or which cannot be prevented or stabilised by medical intervention, or regarding the presence of a serious, untreatable condition which might not become manifest until some time after the medical check. Accordingly, this provision effectively prohibits the use of presymptomatic or susceptibility genetic testing for serious, untreatable disorders Furthermore, section 5 deals specifically with medical checks connected to the closure or amendment of insurance contracts. It provides that no such medical test shall involve questioning the applicant s blood relatives or, unless the condition is manifest, the applicant himself, about hereditary conditions, or about genetic tests which the applicant or his relatives have undergone, or the results of such tests, unless the sum insured exceeds the enquiry limit. The enquiry limit is currently set, in the case of disability insurance contracts, at 60,000 Dutch guilders for the first year of occupational disability, and 40,000 Dutch guilders per year thereafter. Where life insurance contracts are concerned, the enquiry limit is set at 300,000 Dutch guilders. Subsection 5(2) states that these enquiry limits are to be adjusted every three years, in line with the cost of living index. Section 5 also prohibits the use of genetic information in the assessment of an insurance proposal, regarding the applicant or the applicant s blood relatives, that has not been obtained in connection with that proposal. 134 Medical Checks Act Note, the version obtained from the Dutch Ministry of Health for the purposes of this report is an unofficial translation. 136 Medical Checks Act 1997, s.1. 37

41 SUMMARY 2.60 The issue of genetic discrimination in insurance is one of the most contentious, and, accordingly, it has attracted the attention of national legislators and policy-makers. Both the Netherlands and the USA 137 have enacted legislation that restricts genetic discrimination in insurance; Australia has attempted to; the Swedish State has signed an agreement with insurers governing their use of genetic information; and the German Bundestag has set up a Commission of Inquiry into Law and Ethics in Modern Medicine which will consider, amongst other things, genetic information. Notwithstanding the fact that these countries all agree that some form of regulation of insurers use of genetic information is required, the type and terms of the protections differ considerably One explanation for some of the variation is that there are fundamental differences in terms of national provision of health care. For example, the Australian Medicare system provides universal health care to Australians, whereas the overwhelming majority of Americans rely on health insurance to meet their health care needs. Accordingly, US legislation focuses predominantly on prohibiting unfair discrimination with respect to health insurance, whereas the universal provision of health care under the Australian Medicare scheme means that the discrimination issues are of most relevance with respect to life, disability, and employment insurance The Netherlands and Sweden have both adopted the approach of setting an enquiry limit, beyond which the restrictions on insurers use of genetic information will not apply. In addition, the Dutch Medical Checks Act 1997 contains a separate provision which explicitly prohibits the use of presymptomatic or susceptibility testing for serious, untreatable disorders on the basis that such tests entail a disproportionate risk for the subject as against the usefulness of the test to the commissioning party. Accordingly, such testing is never permissible. However, the enquiry limit approach was rejected in the Australian Democrat s Genetic Privacy and Non-discrimination Bill 1998 on the basis that it was impossible to determine the level at which the enquiry limit should be fixed In terms of the restrictions provided by the various legislation, voluntary codes, and agreements, there is a general consensus that it is inappropriate to permit insurers to require applicants to undergo genetic testing as a condition of obtaining insurance. For example, the Australian Life, Investment, and Superannuation Association (LISA) provides in its voluntary code that members will not initiate any genetic tests on applicants for insurance. Similarly, the agreement between the Swedish State and the Swedish Insurance Federation stipulates that members of the Federation are not permitted to require insurance applicants to undergo genetic testing as a condition for taking out insurance. Furthermore, the German Society of Human Genetics states that allowing insurers to require applicants to undergo genetic testing would be incompatible with an individual s right not to know There is less agreement, however, as to what use insurers should be able to make of existing genetic information. As noted above, the restrictions on insurers use of existing genetic information in Sweden and The Netherlands do not apply where the policy exceeds the enquiry limit. Both Sweden and The Netherlands prohibit insurers from enquiring about genetic tests the applicant has undergone, and about the incidence of family hereditary diseases. 138 In contrast, the proposed Australian legislation would have permitted insurers to request, require, or use existing genetic information, although it prohibited insurers from using this information to discriminate against healthy individuals. Surprisingly, no attempt was made to define the term healthy. 137 At a state level. 138 Although the latter is permissible under the Dutch Medical Checks Act if the condition is manifest in the applicant. 38

42 2.65 Another key difference in the various regulation is the meaning given to genetic testing and genetic information. Some regulation construes genetic testing very narrowly, whereas other regulation defines it more inclusively. For example, the Swedish Agreement restricts the definition of genetic testing, for the purposes of the agreement, to presymptomatic, predictive, and susceptibility testing. In contrast, legislation enacted in South Carolina and Maine provide that a genetic test is any laboratory test for determining the presence or absence of genetic characteristics in an individual. Moreover, legislation such as the Medical Checks Act does not define either genetic testing or genetic information because such definitions are not relevant to the application of its provisions. Accordingly, it is not really possible, or indeed appropriate, to isolate the definitions of such terms for the purpose of comparison, as each must be read and understood in its context; that is, in terms of the aims and purpose of the legislation (or policy), and in light of the terms of other provisions. 39

43 EMPLOYMENT AUSTRALIA 3.1 At present, there is no Australian legislation that specifically deals with the use of genetic testing by employers. Accordingly, there is no legislation that prevents employers from requiring employees or applicants to undergo genetic analysis. 3.2 The anti-discrimination legislation applicable in the employment context is substantially the same as that applicable in the insurance context. 139 At a federal level, the Disability Discrimination Act 1992 (Cth) and the Human Rights and Equal Opportunity Commission Act 1986 (Cth) are of most relevance. With the exception of Tasmania, antidiscrimination legislation is also provided at a State level. However, as in the case of insurance, all the legislation contains an exemption that allows employers to discriminate against employees on the grounds of disability in certain circumstances. 3.3 The exact formulation of the exemption varies from one Act to another. However, the general principle is that it may be lawful for an employer to discriminate against an employee on the grounds of disability if the employee would be unable to perform the essential requirements of the job because of his/her disability, 140 or, in order to carry out those requirements, would require services or facilities which would impose an unjustifiable burden on the employer The limitations of existing legislation have led many commentators to conclude that existing industrial relations, privacy and anti-discrimination legislation does not provide adequate protection for employees against improper or unfair use of genetic testing in employment. 142 Indeed, this was the conclusion reached by the Senate Legal and Constitutional Legislation Committee in its report on the Genetic Privacy and Antidiscrimination Bill, published in March The Genetic Privacy and Non-discrimination Bill The Bill contains provisions dealing specifically with the use of genetic testing in employment. As in the case of insurance discrimination, the general rule set out in clause 17(1), that genetic discrimination is unlawful, does not apply in respect of employment, except as provided by clause 18 of the Bill. Discrimination by Employers or Potential Employers 3.6 Clause 18 makes genetic information available to employers in certain circumstances. Employers are permitted to request, require or use an employee s genetic information if the purpose of doing so is either (i) to help a genetically susceptible employee avoid occupational exposure to substances with a mutagenic or teratogenic effect, or (ii) to determine a genotype that is otherwise directly related to the work and is consistent with business necessity. Clause 18 states that employers must not, however, request, require, or use genetic information for the purpose of restricting any right or benefit otherwise due or available to an employee or prospective employee. 139 See above, para David Keays, The Legal Implications of Genetic Testing: Insurance, Employment and Privacy (1999) 6 Jnl of Law and Med 357, p Disability Discrimination Act 1992 (Cth), s.15(4). 142 For example, the Research Group for the Study of the Legal and Ethical Implications of Human Genetic research in Australia, Implications of the Human Genome Project for Australian Employment Law and Practice, Dr Margaret Otlowski, p.13; the Privacy Commissioner, Information Paper No.5: The Privacy Implications of Genetic Testing, p.86, cited in The Committee, chp.4, p.8. 40

44 3.7 Clause 18 was drafted in this way because it was considered that in doing so the provision would: leave open the potential for genetic testing to improve health and safety at work (which a complete prohibition of genetic testing by employers would not); be consistent with existing anti-discrimination legislation in Australia, which recognises some limited forms of acceptable discrimination in employment; place the onus on employers to ensure that workplaces are healthy and safe by removing the possible claim that they could not take advantage of genetic information because it would be discriminatory; prevent employers from creating unhealthy workplaces and selecting employees who are less susceptible to exposure at work because this would not be directly related to the work or consistent with business necessity Moreover, any genetic analysis of employees would be subject to the provisions in Part 3 of the Bill relating to the collection, storage and analysis of DNA samples, 144 including the requirement for informed consent and written authorisation. Any use of genetic information by employers that did not fall within clause 18 or clause would be subject to the existing anti-discrimination legislation. 146 The Bill also contains provisions for individuals to make privacy and discrimination complaints. 147 The Senate Legal and Constitutional Committee 3.9 The Committee considered in detail the issues relating to the use of genetic information in employment With regard to discrimination, the Committee was concerned not only by the possibility that employers may use genetic information to unfairly discriminate against individuals as a result of misunderstanding the genetic information, but that, equally, employers may positively discriminate by seeking to appoint employees considered to possess desirable genetic traits. 148 The committee considered that the latter form of discrimination may become more of an issue as genetic testing advances and possible links are discovered between certain genes and characteristics such as intelligence or criminality With regard to privacy issues, the committee was particularly concerned that requiring an employee or prospective employee to undergo genetic testing would conflict with an individual s right not to know The committee concluded that although the Bill prohibits unfair discrimination by potential employers, it nevertheless does not fully address privacy and discrimination issues. Accordingly, the committee recommended that further legislation be developed to protect privacy rights and address discrimination concerns. 150 CANADA 143 Australian Democrats, Genetic Privacy and Non-discrimination Bill 1998: Additional Comments (March 1999), pp See above, para 1.24 and following. 145 Clause 20: Research involving genetic analysis. See below, para 6.15 and following. 146 See above, para See below, para The Committee, chp.4, p Id. 150 Id. 41

45 3.13 As in the case of genetic testing in insurance, there is currently no Canadian legislation enacted or proposed that deals specifically with the issue of genetic discrimination in employment. 151 However, this is also an area that is likely to attract attention in the future, and developments should be monitored. Also, note the protections provided to personal health information by the Personal Information Protection and Electronic Documents Act 2000, 152 which will apply to personal health information from 1 January USA 3.14 Unlike in most other countries, there is considerable anecdotal evidence of genetic discrimination by employers in the USA. 153 However, the explanation for this disparity lies in the fact that the overwhelming majority of Americans rely on employer provided health insurance to meet their health care needs. Indeed, a report published by the Congressional Office of Technology Assessment (OTA) in indicated that forty-two percent of the companies surveyed 155 considered a job applicant s health insurance risks a factor in determining employability, and thirty-six percent actively engaged in health insurance risk assessment of job applicants. 156 Moreover, twelve responding companies reported that they were already using biochemical genetic screening Given that this issue does not arise in the UK, 158 and the differences generally between the US and UK legal and social systems, a direct comparison is not particularly instructive, nor necessarily appropriate. Notwithstanding, it is worth outlining the position in the USA as it is still of relevance to the wider issues involved in the use of genetic information by employers. Federal 3.16 As yet, no federal legislation has been passed that explicitly addresses genetic discrimination in the workplace, although several bills have been introduced during the last decade. 159 Some of these bills have attempted to amend existing civil rights and labour laws, whilst others have stood alone On 8 February 2000, President Clinton signed an executive order that prohibits federal departments and agencies from using genetic information in any hiring or promoting action. Genetic information means information about an individual s genetic tests, or those of family members, and information about the occurrence of a disease or disorder in family members. A genetic test is the analysis of human DNA, RNA, chromosomes, proteins, or certain metabolites in order to detect disease-related genotypes or mutations In addition, President Clinton called on Congress to protect personal genetic information and endorsed the Genetic Non-discrimination in Health Insurance and Employment Act of 1999, introduced by Senator Daschle. Under this bill, the protections for 151 See above, para Considered below, para 4.52 and following. 153 See for example, P R Billings et al, Discrimination as a consequence of genetic screening (1992) 50 Am J Hum Genetics Congressional Office of Technology Assessment, Genetic Monitoring and Screening in the Workplace (1990). 155 The survey was based on the Fortune 500 companies, the fifty largest utilities, and thirty-three major unions. 156 M, A. Rothstein, Genetic Discrimination in Employment and the Americans with Disabilities Act, Houston Law Rev 29:1 (1992) 23, at p Id., p Although, note, the increase in employers offering health insurance as an employee benefit. 159 Similar legislation has been introduced in the 106 th Congress, e.g. the Genetic Non-discrimination in Health Insurance and Employment Act of 1999 (Senator Tom Daschle), the Genetic Non-discrimination in Health Insurance and Employment Act of 1999 (Representative Louise Slaughter), and the Genetic Privacy and Non-discrimination Act of 1999 (Representative Cliff Stearns). 42

46 genetic information contained in Clinton s executive order would be extended to the private sector. The executive order: prohibits federal employers from requiring or requesting genetic tests as a condition of being hired or receiving benefits; prohibits federal employers from using genetic information to deprive employees of advancement opportunities; and provides privacy protections to any genetic information used for medical treatment and research Despite the fact that no specific federal legislation prohibiting genetic discrimination has been enacted, several commentators have argued that existing non-discrimination laws may be interpreted to include genetic discrimination. The Americans with Disabilities Act At present, the most likely source of protection against genetic discrimination in the workplace is the Americans with Disabilities Act 1990 (ADA). 160 Although it was not specifically drafted to address the issue of genetic discrimination, many believe that the overarching policy of the ADA, to prohibit discrimination based on health status, is sufficiently broad to encompass discrimination based on most genetic diseases Employment discrimination is addressed by Title 1 of the ADA, and responsibility for enforcing the provisions contained therein lies with the Equal Employment Opportunity Commission (EEOC) Section 102(a) of the ADA contains the general prohibition against discrimination in employment: No covered entity shall discriminate against a qualified individual with a disability because of the disability of such individual in regard to job application procedures, the hiring, advancement, or discharge of employees, employee compensation, job training, and other terms, conditions, and privileges of employment For the purpose of the Act, disability means: (i) a physical or mental impairment that substantially limits one or more of the major life activities of the individual; (ii) a record of such an impairment; or (iii) being regarded as having such an impairment. 162 Medical Examinations and Inquiries 3.24 Some of the most radical changes in employment practices mandated by the ADA relate to medical examinations and inquiries In terms of pre-employment examinations of applicants, employers may inquire as to the applicant s ability to perform job-related duties (e.g. lifting objects), but may not conduct a medical examination or make inquiries of a job applicant as to whether such applicant is an individual with a disability or as to the nature or severity of such disability. 164 With regard to 160 For a detailed analysis of genetic discrimination in employment under the ADA, see M, A. Rothstein, Genetic Discrimination in Employment and the Americans with Disabilities Act, Houston Law Rev 29:1 (1992) Id., p ADA, s M, A. Rothstein, Genetic Discrimination in Employment and the Americans with Disabilities Act, Houston Law Rev 29:1 (1992) 23, p ADA, s.102(d). 43

47 genetic-related inquiries, it has been suggested that it is no longer lawful for employers to inquire about an applicant s past, current or future genetic conditions, or as to the medical history of the applicant s family In contrast, after a conditional offer of employment has been made, employers may require individuals to undergo an employment entrance examination, and the offer of employment may be subject to the results of the examination. 166 The only restriction is that all entering employees must be required to undergo an examination regardless of disability. 167 Of particular concern with regard to genetic discrimination is the statement by the EEOC that medical examinations conducted in accordance with this section do not have to be jobrelated and consistent with business necessity. 168 Although the EEOC regulation stipulates that the results of such examinations may not be used for screening purposes, allowing nonjob-related examinations gives rise to problems other than discrimination. A specific statutory aim of the ADA is to prevent employers from compelling disclosure of non-job-related medical information, in recognition of the fact that individuals with disabilities may face stigmatisation, and of the need to protect such individuals privacy and dignity Once hired, employees may not be required to submit to medical examinations or other inquiries concerning the nature or severity of disabilities, unless such examinations or inquiries are shown to be job-related and consistent with business necessity. 170 Application to Genetic Disorders 3.28 In March 1995, the EEOC issued an interpretation of the ADA. 171 However, the interpretation is policy guidance that does not have the same legally binding effect on the courts as a statute or regulation and, accordingly, is limited in scope and legal effect. As yet, the interpretation has not been tested in court. According to the interpretation: entities that discriminate on the basis of genetic predisposition are regarding the individuals as having impairments, 172 and such individuals are covered by the ADA. unaffected carriers of recessive and X-linked disorders and individuals with late onset genetic disorders, who may be identified through genetic testing or through family history as being at risk of developing the disease, are not covered by the ADA. Summary 3.29 The Americans with Disabilities Act 1990 provides the following protections against genetic discrimination in the work place: prohibits discrimination against a person regarded as having a disability; protects individuals with symptomatic genetic disabilities the same as individuals with other disabilities; 165 M, A. Rothstein, Genetic Discrimination in Employment and the Americans with Disabilities Act, Houston Law Rev 29:1 (1992) 23, p ADA, s.102(d)(3) M, A. Rothstein, Genetic Discrimination in Employment and the Americans with Disabilities Act, Houston Law Rev 29:1 (1992) 23, p Equal Employment Opportunity for Individuals with Disabilities 56 Fed. Reg. 35,726 app. At 35,751 (1991), cited in M, A. Rothstein, Genetic Discrimination in Employment and the Americans with Disabilities Act, Houston Law Rev 29:1 (1992) 23, p M, A. Rothstein, Genetic Discrimination in Employment and the Americans with Disabilities Act, Houston Law Rev 29:1 (1992) 23, p ADA, s.102(d)(4) The third part of the definition of disability in s.2 of the ADA. 44

48 does not protect against discrimination based on unexpressed genetic conditions; does not protect prospective employees from requirements or requests to provide genetic information to the employer after a conditional offer of employment has been made but before they start work; does not protect employees from requirements to provide medical information that is job related and consistent with business necessity. 173 The Health Insurance and Portability Act The Health Insurance and Portability Act 1996 (HIPAA) deals specifically with employer-based and commercially issued health insurance. It is considered in the section on Insurance, 174 but should also be noted here. State 3.31 So far, twenty-three states have enacted legislation regarding the use of genetic information in employment. 175 Indeed, in the 1999 state legislative sessions alone, there were over 100 bills introduced regarding genetic discrimination in the work place and/or genetic discrimination by insurers The enacted statutes vary considerably in the scope and terms of the protection they provide. At one end of the spectrum, legislation enacted by states such as Florida and Louisiana provides fairly limited protection against genetic discrimination. For example, in Florida, legislation prohibits any person, firm, corporation, unincorporated association, state agency, unit of local government or any public or private entity from denying or refusing employment to any person, or discharging any person from employment, based on sickle cell trait. 177 Similarly, in Louisiana, the protections, although in themselves quite comprehensive, are restricted to discrimination based on sickle cell trait However, these statutes were enacted a comparatively long time ago, and the trend seems to be that more recent state legislation provides much more comprehensive protection. For example, both North Carolina and New York State initially enacted legislation prohibiting discrimination based on sickle cell trait or haemoglobin C trait, 179 and sickle cell trait, carriers of Tay-Sachs disease or carriers of Cooley s Anaemia, 180 respectively. Both, however, have enacted more recent and more comprehensive legislation In 1997, North Carolina enacted legislation prohibiting employers from refusing to employ any person, or from discharging any person from employment, on account of the person s having requested genetic testing or counselling services, or on the basis of genetic information obtained concerning the person or a member of the person s family. 181 The Act defines genetic information as information about genes, gene products, or inherited characteristics that may derive from an individual or a family member. Genetic test means a test for determining the presence or absence of genetic characteristics in an individual or a member of the individual s family in order to diagnose a genetic condition or characteristic, or to ascertain the susceptibility to a genetic condition. A genetic characteristic is defined as See above, para A summary of enacted state legislation can be found at: Florida (1978) FL ST: δ Louisiana (1982) LA ST 23: North Carolina (1975) NC ST δ New York (1990) CR δ 48-a. 181 North Carolina (1997) S

49 any scientifically or medically identifiable genes or chromosomes, or alterations or products thereof, which are known individually or in combination with other characteristics to be a cause of a disease or disorder, or are determined to be associated with a statistically increased risk of development of a disease or disorder and which are asymptomatic of any disease or disorder In 1996, New York State also enacted more comprehensive legislation 183 which: prohibits employers or licensing agencies from refusing to hire or employ or to bar or discharge from employment on the basis of genetic predispositions or carrier status; prohibits employment agencies from considering genetic pre-disposition or carrier status when acting upon applications for its services or in referring an applicant to an employer; prohibits employers or employment agencies from advertising or using any form of application for employment that expresses any limitation based on genetic predisposition or carrier status; prohibits employers, labour organisations, employment agencies and licensing agencies from: directly or indirectly soliciting, requiring or administering a genetic test to a person as a condition of employment, pre-employment application, labour organisation membership or licensure; buying or otherwise acquiring the results or interpretation of an individual s genetic test results; making an agreement with an individual to take a genetic test or provide genetic test results. provides for employers to require a specified genetic test as a condition of employment where such test is shown to be directly related to the occupational environment, such that an employee or applicant with a particular genetic anomaly might be at an increased risk of disease as a result of working in said environment; and provides for an employee to request genetic tests for a workers compensation claim, for civil litigation or to determine the employee s susceptibility to potentially hazardous chemicals in the workplace, if the employee provides written and informed consent For the purposes of the Act, a genetic test means an assay employing DNA, constituent genes, or gene products, to diagnose or predict the presence of a genetic anomaly that is linked to a physical or mental disease or disability in the individual or the individual s offspring, or susceptibility to, or a predisposition for, a genetically influenced disease or disability A genetic anomaly is defined as any variation in an individual s DNA which has been shown to confer a genetically influenced disease or predisposition to a genetically influenced disease, or makes the individual a carrier of such a variation. Genetic predisposition means the presence of a variation in the composition of the genes of an individual which is scientifically or medically identifiable and which is determined to be associated with a increased statistical risk of being expressed as a physical or mental New York (1996) AB 7839 & SB

50 disease or disability in the individual, but which has not resulted in any symptoms of such disease or disorder Other states with similar legislative protections include Iowa, 185 Missouri, 186 Nevada, 187 and New Jersey. 188 GERMANY 3.39 As in the case of genetic testing in insurance, there is no German regulation at present that addresses the issue of genetic testing in employment. It is likely, however, that this issue will also be addressed by the German Bundestag Commission of Inquiry into Law and Ethics in Modern Medicine. 189 The German Society of Human Genetics: Position Paper 3.40 The Position Paper of the German Society of Human Genetics (GfH) 190 adopts the same approach to genetic testing in employment as it does to genetic testing in insurance. 191 The GfH considers that an individual s right to control access to information about him/herself requires legislation prohibiting genetic discrimination in employment, and that an individual s right not to know requires that private and public institutions such as employers should not be able to require individuals to undergo genetic testing. The GfH also considers that legislation is required to ensure that diagnostic genetic testing to clarify the risk of occupational diseases is only utilised on a voluntary basis. 192 The Federal Medical Council 3.41 The German Federal Medical Council has issued a comment on the so-called genome analysis of employees but, unfortunately, this is not available in English. SWEDEN 3.42 There is currently no legislation in Sweden that deals specifically with the use of genetic information by employers, or prohibits employers from requiring applicants or employees to undergo genetic testing. However, under existing legislation, genetic information, like other medical information, may not in principle be disclosed to third parties such as employers without the individual s consent. 193 Moreover, the Ministry of Health and Social Affairs has stated that it would be unethical to require genetic analysis as a condition of employment, as this would violate the liberty of the individual and be incompatible with humanist principles Furthermore, in 1999 the Swedish Parliament resolved on a communication from the Government stating its intention to appoint a parliamentary committee to consider how genetic integrity is to be maintained in every sector of society. It is likely, therefore, that the committee will consider the issue of genetic testing in employment. 185 Iowa (1992) IA ST: δ Missouri (1998) MO ST: Nevada (1999) SB New Jersey (1996) NJ SB See above, para Deutsche Gessellschaft fur Humangenetik e.v., Position Paper of the German Society of Human Genetics (1996). 191 See above, para Position Paper of the German Society of Human Genetics (1996), p.a See below, para Ministry of Health and Social Affairs, Swedish Act Concerning Use of Gene Technology on Human Beings 1991 (English Summary), p.5. 47

51 THE NETHERLANDS The Medical Checks Act The Medical Checks Act 1997, which strengthens the legal position of individuals undergoing medical checks in connection with insurance contracts, 195 also contains provisions which restrict the use of medical examinations undertaken in connection with employment. As in the case of insurance, the general prohibition in section 3, which effectively excludes the use of presymptomatic genetic testing for serious, untreatable conditions, 196 applies equally in the context of employment In the context of employment, medical check encompasses both enquiries regarding the health of a subject and medical tests made or performed in connection with the establishment or amendment of any of the following: a civil contract of employment recognised under or pursuant to the Sickness Benefits Act or the Disability Insurance Act; a contract of public service; an insurance contract which the individual s employer has closed or intends to close to cover the risk arising out of the employer s statutory sick pay obligations, or disability payment obligations. Restriction of Medical Checks 3.46 Section 4 of the Act details the restrictions that apply to medical checks undertaken in connection with employment. Firstly, requiring employees, prospective employees, public servants or prospective public servants to undergo a medical check in connection with a civil contract of employment, or contract of public service, is prohibited, unless the duties to which the contract relates require special medical fitness. Medical fitness includes the individual s ability to perform the duties without causing a risk to his own health and safety, or to that of others Secondly, under subsection 5(2) employers or prospective employers are not entitled to require an individual to undergo a medical check until assessment of his suitability against other criteria is complete and the employer has decided to appoint the individual, subject to medical fitness Thirdly, an employer cannot require an employee to undergo a medical check prior to admission to a pension scheme. However, if a permanent employee wants to change the basis of his or her participation, a medical check may be required. 197 Similarly, an individual cannot be required to undergo a medical check prior to admission to a scheme which provides occupational disability insurance cover, separate from that provided by a pension, and which is linked to a civil contract of employment, or a contract of public service Furthermore, employers may not require employees to undergo a medical check in connection with an insurance contract which the employer has closed or intends to close to 195 See above, para See above, para Medical Checks Act 1997, s.4(3). 198 Medical Checks Act 1997, s.4(4). 48

52 cover the risk arising from the employer s statutory obligation to pay sick pay and disability benefit Finally, subsection 6(5) stipulates that where a medical check may not be required (pursuant to section 4), if an employee wants to participate in a pension scheme, or if the employer wishes to close or amend an insurance contract referred to in subsections 4(4) and (5), the insurer is prohibited from excluding or diminishing any right on the grounds of sickness, medical condition or disability. SUMMARY 3.51 Thus far, the only countries 200 with specifically enacted legislation to restrict employers use of genetic information are The Netherlands and the USA. The Australian Genetic Privacy and Non-discrimination Bill 1998 would have addressed the issue had it been enacted, but the Senate Legal and Constitutional Committee recommended that the Bill did not proceed, pending further consideration of the issues. In those countries that do not have specific regulations prohibiting or limiting employers access to, and use of, genetic information, existing anti-discrimination and privacy legislation may, nevertheless, provide individuals with some protection The Dutch Medical Checks Act 1997 provides similar restrictions on employers use of genetic testing and genetic information as it does on insurers. Accordingly, presymptomatic and predictive testing for serious, untreatable disorders is prohibited on the basis that it entails a disproportionate risk for the individual being tested as against the usefulness of the test for the commissioning party. In the specific context of employment, medical checks encompasses both inquiries regarding the health of a subject and tests made or performed in connection with civil contracts of employment, public service contracts, and employers insurance contracts taken out to cover the risk arising out of the employer s statutory sick pay and disability payment obligations. The Act prohibits such medical checks in connection with civil or public contracts of employment, unless the position requires a special degree of medical fitness, which includes the individual s ability to perform the duties safely. The Act also restricts medical checks made in connection with pension schemes, or insurance contracts intended to cover the employer s statutory sick pay and disability payment obligations In the USA, there is limited protection at a federal level. Existing anti-discrimination legislation, such as the Americans with Disabilities Act 1990, provides some degree of protection against genetic discrimination, although President Clinton himself has called on Congress to enact more comprehensive legislation. At a state level, however, there is a considerable body of genetic non-discrimination legislation, although the enacted statutes vary considerably in the scope and terms of the protection they provide. The most comprehensive protections, such as New York, only permit employers to require applicants to undergo genetic testing where this is directly related to the occupational environment. It also prohibits employers from buying or otherwise acquiring the results or interpretation of an individual s genetic test results Similarly, current protections in Australia derive from the existing general disability discrimination legislation. However, the Senate Legal and Constitutional Committee concluded that such legislation does not provide adequate protection for employees against improper or unfair use of genetic testing. The Committee was also of the opinion that 199 Medical Checks Act 1997, s.4(5). 200 Of those studied in this report. 49

53 allowing employers to require applicants or employees to submit to genetic testing would conflict with an individual s right not to know The German Society of Human Genetics has also stated in its position paper that the right not to know means that third parties such as employers should not be able to require individuals to undergo genetic testing. Moreover, they have argued that an individual s right to control access to information about him or herself requires the enactment of legislation prohibiting genetic discrimination in employment. It is likely that the issue will be considered by the recently appointed German Bundestag Commission of Inquiry into Law and Ethics in Modern Medicine Sweden is another country that currently relies on existing legislation to regulate employers access to, and use of, genetic information. Under this legislation, genetic information, like other medical information, may not be disclosed to third parties such as employers without the relevant individual s consent Given that both Australia and the USA consider their existing protections to be inadequate, it is likely that these countries will enact specific legislation in the future. 50

54 DATA PROTECTION AND PRIVACY AUSTRALIA 4.1 Privacy protection in Australia derives from a combination of legislation, common law doctrines and self-regulatory measures that vary in coverage and content. Consequently, Australia does not have a nationally consistent privacy protection system. At a federal level, the pre-eminent privacy protection legislation is the Privacy Act 1988 (Cth). At a state level, only New South Wales and the Australian Capital Territory have any degree of legislative protection of privacy in the private sector. 201 At common law, a number of remedies arise under contract, equity and tort, providing a further (albeit somewhat limited) mechanism for privacy protection. 202 The Privacy Protection Act The core obligations and prohibitions arising under the Act are contained in the 11 privacy principles, which form the basis of the Act. These principles regulate, inter alia, the purpose of the collection of personal information, 203 the storage of personal information 204 and access to records, 205 limitations on the use of personal information, 206 and the disclosure of personal information. 207 The definition of personal information contained in s.6(1) is sufficiently broad to cover certain genetic information. 208 It is defined as: information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion. 4.3 However, the application of the Act is severely restricted in that it is limited to government agencies. 209 Accordingly, it would not provide any privacy protection against private sector organisations handling or storing the results of genetic tests, including employers and insurers. Indeed, s.12a of the Act specifically provides that it does not apply in relation to State banking or insurance. Moreover, the Privacy Commissioner commented, in the discussion paper entitled Privacy Implications of Genetic Testing, that there is currently no legislation or regulation that prohibits insurance companies sharing information or selling it to third parties. 210 It is only the insurance industry s own voluntary code that provides any standard of confidentiality at all in the handling and storage of genetic information. 4.4 The lack of any effective legislation or regulation in this area has led to several attempts at reform. 201 See the Privacy Committee Act 1975 (NSW) and the Health Records (Privacy and Access) Act 1997 (ACT). Both these Acts provide limited protection. 202 For example, a legal duty of confidentiality, as contained in a contract, may confer upon a party to the contract some protection of privacy, as well as remedies if that privacy is infringed. 203 Privacy Act 1988 (Cth), s.14, Principle Privacy Act 1988 (Cth), s.14, Principle Privacy Act 1988 (Cth), s.14, Principle Privacy Act 1988 (Cth), s.14, Principle Privacy Act 1988 (Cth), s.14, Principle David Keays, The Legal Implications of Genetic Testing: Insurance, Employment and Privacy (1999) Jnl of Law and Med 357, p Privacy Act 1988 (Cth), ss.14, 6 and David Keays, The Legal Implications of Genetic Testing: Insurance, Employment and Privacy (1999) Jnl of Law and Med 357, p

55 The Privacy Amendment Bill The Privacy Amendment Bill 1998 (Cth) extends the operation of the Privacy Act 1988 (Cth) to Commonwealth contractors performing work outsourced by the Government. The Bill was referred to the Senate Legal and Constitutional References Committee on 14 May 1998, to be considered as part of its wider inquiry into privacy in the private sector. The committee published its report, entitled Privacy in the Private Sector: Inquiry into Privacy Issues, including the Privacy Amendment Bill 1998, on 25 March Ultimately, the Bill was not enacted and so will not be considered in detail. Instead, the Senate Committee s reasons for rejecting the Bill will be outlined, as will the committee s key recommendations. Senate Legal and Constitutional References Committee 4.6 The committee examined in detail privacy issues in the private sector, concluding that there is a substantial body of evidence of widespread community concern over the lack of protection of privacy rights generally. 212 The committee considered that whilst industry may have legitimate concerns about regulation, the interests of industry should not be permitted to override individuals right to privacy. In terms of the detail and content of privacy protections, the committee considered the most appropriate guide to be existing international benchmarks and best practice standards, such as the European Union Directive on Data Protection Chapter 6 of the Senate report examines the Privacy Amendment Bill 1998 and its adequacy in addressing the lack of privacy protection identified in previous chapters (which led the committee to conclude that neither law nor self-regulation currently provide adequate privacy safeguards over the private sector). In light of the fact that the Bill is intended to ensure the continuation of existing protections only, 214 the committee concluded that the objectives of the Bill are inadequate to meet the wider need for privacy protection over the private sector in Australia. 215 Indeed, the committee only supported the objectives of the Bill to the extent that it recognised an urgent need to counteract the erosion of privacy protection under the Privacy Act caused by the increase in contracting out of government services In light of the findings of its inquiry, the Senate Committee recommended: that the government introduce legislation to provide uniform privacy protection across the public, private, charitable and not for profit sectors, and that the coverage of the legislation be as broad as possible and that the extent of any exemptions be minimised; 217 that the creation of a co-regulatory model (the preferred solution for addressing the need for privacy protection in the private sector) should incorporate a comprehensive review of the Privacy Act, creating a single universally applicable source of law; 218 that the National Privacy Principles should be carefully revised, taking into account the European Directive on Data Protection. Until such revision has occurred, the National Principles would not be an appropriate base for legislation Senate Legal and Constitutional References Committee, Privacy in the Private Sector: Inquiry into Privacy Issues, including the Privacy Amendment Bill 1998, 25 March 1999 (hereinafter Privacy Inquiry). 212 Privacy Inquiry, chp Privacy Inquiry, chp Second Reading Speech, cited in Privacy Inquiry, chp.6, p Privacy Inquiry, chp.6, p Id. 217 Recommendation 4 (paragraph 6.52), Privacy Inquiry. 218 Recommendation 8 (paragraph 7.116), Privacy Inquiry. 219 Recommendation 6 (paragraph 6.63), Privacy Inquiry. 52

56 The Genetic Privacy and Non-discrimination Bill A specific aim of the Genetic Privacy and Non-discrimination Bill 1998 (Cth) is to establish uniform rules that protect an individual s right to genetic privacy. 220 Consequently, Part 2 of the Bill contains detailed provisions regulating the disclosure of genetic information to third persons, which apply in all contexts, i.e. public and private sector, employment, insurance, etc. Disclosure of Genetic Information 4.10 Clause 8(2) provides that a person may only disclose genetic information derived from a DNA sample and held in a genetic record if: the individual has authorised the disclosure; or the disclosure is required or authorised by or under law; or the person has reasonable grounds to believe that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual or of another person Under clause 8(2), the person to whom genetic information has been disclosed may re-disclose the information only to the extent reasonable in the exercise of judgement for professional medical consultation for the direct benefit of a patient, or with the written authorisation of the individual For the purposes of the Bill, a DNA sample includes a human tissue sample from which it is intended to extract DNA; DNA extracted from such tissue samples; and other molecules (such as ribonucleic acids and polypeptides) from which DNA may be derived. It does not, however, include a tissue sample that is taken as a biopsy or autopsy specimen, or as a clinical specimen, solely for the purpose of conducting an immediate clinical or diagnostic test that is not a DNA test, or a blood sample taken solely for the purpose of storage in, and distribution by, a blood bank A genetic record means information (including information forming part of a database), whether compiled lawfully or unlawfully, and whether recorded in a material form or not, that records genetic information of an individual in a manner connecting it with the person s identity. 222 Authorisation for Disclosure 4.14 Clause 9 sets out the criteria that must be satisfied for there to be a valid authorisation to disclose genetic information To be valid, the authorisation must be in signed writing, dated on the day of the signature. The authorisation must identify both the person authorised to make the disclosure, and the specific genetic information to be disclosed. Furthermore, the authorisation must identify the person to whom the information may be disclosed, and describe the purpose for which the disclosure is being made. The authorisation must also state the date upon which the authorisation expires, and include a statement that the authorisation may be revoked or amended at any time prior to the disclosure. A copy of the authorisation should be provided to the individual concerned, and a separate copy should be kept with the genetic record. The 220 Genetic Privacy and Non-discrimination Bill 1998 (Cth), cl.6(e). 221 Genetic Privacy and Non-discrimination Bill 1998 (Cth), cl Id. 53

57 clause also provides that a general authorisation for the release of medical records or information is not to be construed as an authorisation for disclosure of genetic information. The Senate Legal and Constitutional Committee 4.16 The Senate Committee addressed a number of ethical issues relating to the disclosure of genetic information to third parties. Firstly, the committee considered that there are likely to be situations in which a person s right to privacy will conflict with a medical practitioner s wider duty to inform relatives of risks to their health. 223 For example, if a test reveals an individual to be suffering from a genetic disease or predisposition, this information is likely to be directly relevant to the tested individual s family. If the individual refuses to disclose this information, when would it be permissible for a medical practitioner to do so? Moreover, if an obligation was created for medical practitioners to disclose such information, how would this obligation be reconciled with an individual s right not to know? A further issue of particular concern to the committee was that of access to information contained in collections of tissue samples originally collected for a purpose other than genetic analysis, e.g. Guthrie spots, collected as part of newborn screening programmes The committee concluded that the protections proposed by the Bill did not adequately address these concerns, particularly in relation to the private sector. In particular, the committee considered that, although the Bill is intended to apply to all sources of genetic information which should be afforded privacy protection (in all contexts), additional regulation would be required in relation to information contained in collections associated with new-born screening programmes, in order to protect the privacy rights of persons whose samples are held in such collections. The Privacy Amendment (Private Sector) Bill The most recent attempt at reforming Australian privacy protection is the Privacy Amendment (Private Sector) Bill 2000, which has been presented and read a first time by the Australian House of Representatives. The stated objective of the Bill is: to establish a single comprehensive national scheme providing, through codes adopted by private sector organisations and National Privacy Principles, for the appropriate collection, holding, use, correction, disclosure and transfer of personal information by those organisations In light of this objective, it would seem that the Bill is an attempt to reform Australian privacy protections along the lines recommended by the Senate Legal and Constitutional References Committee in their rejection of the Privacy Amendment Bill 1998 (Cth). 226 Health Information 4.20 The first significant amendment made by the Bill is that it would insert into the Privacy Act 1988 a definition of health information. 227 The definition is very broad and would certainly include genetic information. Under the Bill, health information means information or an opinion about the health or a disability of an individual at any time, 228 or a health service provided, or to be provided to an individual, that is also personal information. It also includes other personal information collected in relation to the provision of a health service, 223 The Committee, chp.4, p See above, para Privacy Amendment (Private Sector) Bill 2000 (Cth), cl See above, para 4.7 and following. 227 Privacy Amendment (Private Sector) Bill 2000, cl Emphasis added. 54

58 or in connection with the donation by an individual of his/her body parts, organs, or bodily substances. The National Privacy Principles 4.21 The Bill also provides a revised set of National Privacy Principles (NPP), contained in Schedule 3 of the Bill NPP 1 regulates the collection of personal information by an organisation. The principle provides that any information collected must be necessary for one or more of the functions or activities of the organisation, and must only be collected by lawful means. As soon as is practicable, an organisation collecting information about an individual must take reasonable steps to inform the individual of, inter alia: the identity of the organisation and how to contact it; the fact that s/he can gain access to the information; the purposes for which the information has been collected; and the organisations to which the information may be disclosed NPP 2 regulates the use and disclosure of personal information by an organisation. It prohibits disclosure of information about an individual for a purpose other than that for which the information was originally collected, unless the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use or disclose the information for the secondary purpose. Otherwise, the individual concerned must have consented to the secondary disclosure or use The principle provides that health information may be used or disclosed for research, or for the compilation or analysis of statistics, if: it is impracticable for the organisation to seek the individual s consent prior to use or disclosure; the use or disclosure is conducted in accordance with guidelines approved by the Privacy Commissioner under section 95A; and, in the case of disclosure, the organisation reasonably believes the recipient will not disclose the health information, or personal information derived from it Furthermore, the information may be used or disclosed if the organisation reasonably believes it to be necessary to lessen or prevent a serious and imminent threat to an individual s life, health or safety, or a threat to public health and safety NPP 3 provides that an organisation must take reasonable steps to ensure that the information it collects, uses, or discloses is accurate, complete and up-to-date NPP 4 provides that an organisation must take reasonable steps to ensure the security of the personal information it holds, and that any information that is no longer required is de-identified or destroyed NPP 5 relates to openness of information. An organisation should have a clear policy on how it manages personal information, and should take reasonable steps to answer 229 Privacy Amendment (Private Sector) Bill 2000, cl

59 any public inquiries about why and how it collects, uses, stores, or discloses personal information NPP 6 sets out the general principle that an organisation should provide individuals with access to the information it holds about them. However, there are several exceptions to this principle. For example, in the case of health information, if providing access would pose a serious threat to the life or health of any individual, or would have an unreasonable impact upon the privacy of other individuals, or the request for access is frivolous or vexatious NPP 7 contains provisions relating to the use of identifiers, which include numbers assigned by an organisation to an individual for the purposes of the organisation s operations NPP 8 provides that wherever it is lawful and practicable, an individual should have the option of not identifying themselves when entering into transactions with an organisation NPP 8 regulates transborder data flows NPP 9 contains specific provisions relating to the collection of sensitive information. (N.B. health information is included in the definition of sensitive information 230 ). The principle provides that an organisation must not collect sensitive information about an individual unless: the individual has consented; or the collection is required by law; or the collection is necessary to prevent or lessen a serious and imminent threat to the life or health of any individual, where the individual whom the information concerns is incapable of giving consent to the collection or cannot communicate consent; or the collection is necessary for the establishment, exercise or defence of a legal or equitable claim Despite this general rule, an organisation may collect health information about an individual if the collection is necessary for research, or for the compilation or analysis of statistics relevant to public health and safety, and that purpose cannot be served by the collection of de-identified information. Approved Privacy Codes 4.35 Because the Privacy Amendment (Private Sector) Bill 2000 aims at establishing a co-regulatory national scheme, 231 as well as setting out the National Privacy Principles, the Bill also contains provisions governing the approval of privacy codes. It is the responsibility of the Privacy Commissioner to approve a privacy code, and an organisation may apply in writing for approval Clause 58 of the Bill sets out detailed provisions which must be met before the Commissioner may approve a privacy code. These include, amongst others: that the code incorporates the obligations set out in the National Privacy Principles; 230 Privacy Amendment (Private Sector) Bill 2000, cl.27(b). 231 See above, para

60 that the code identifies (or provides a means of identifying) the organisations bound by the code; that members of the public have been given adequate time to comment on the draft of the code; and that the determinations, findings, declarations, orders and directions that the adjudicator may make under the code after investigating a complaint are the same as those that the Commissioner may make under clause 52 after investigating a complaint under the Bill The clause also sets out the circumstances in which an approved privacy code may be varied or revoked. Breach of a National Privacy Principle or Approved Privacy Code 4.38 Clause 36 provides that an act or practice will breach a National Privacy Principle if, and only if, it is contrary to, or inconsistent with, that Privacy Principle. Similarly, an act or practice will breach an approved privacy code if, and only if, it is contrary to, or inconsistent with, that privacy code The clause also contains a list of exceptions. With regard to the National Privacy Principles, the most significant exception concerns contracted service providers. The exemption states that: an act or practice will not breach a Privacy Principle if the act is done by an organisation that is a contracted service provider for a Commonwealth contract (whether or not the organisation is a party to the contract) for the purposes of meeting an obligation under the contract, and the act or practice is authorised by a provision of the contract that is inconsistent with the Principle. 233 Note, therefore, that arguably the Bill does not address the concern expressed by the Senate Legal and Constitutional References Committee 234 that the protections provided by the Privacy Act 1988 (Cth) were being eroded by the increase in contracting-out of government services Similarly, an act will not breach an approved privacy code if the act is done by a contracted service provider for a Commonwealth contract for the purposes of meeting (directly or indirectly) an obligation under the contract, and the act or practice is authorised by a provision of the contract that is inconsistent with the code. Privacy Complaints 4.41 Despite the fact that an act or practice done by a contracted service provider will not breach the National Privacy Principles or an Approved Privacy Code, the Bill nevertheless specifies that this does not prevent an individual complaining to the Commissioner about the act or practice engaged in by an organisation purportedly for the purpose of meeting (directly or indirectly) an obligation under a Commonwealth contract. Where the complaint relates to an act or practice contrary to a National Privacy Principle, the complaint should always be addressed to the Commissioner. However, where the complaint relates to an act or practice contrary to an Approved Privacy Code, the Bill requires the adjudicator for the code to refer the complaint to the Privacy Commissioner. Remedies 4.42 A determination made by the Commissioner or an adjudicator may include: 232 See Privacy Amendment (Private Sector) Bill 2000, cl.58. See also below, para Emphasis added. 234 See above, paras 4.5 and

61 an order that the respondent make an appropriate correction, deletion or addition to a record; an order that the respondent attach to the record a statement provided by the complainant that a correction, deletion or addition is sought; a declaration that the complainant is entitled to a specified amount by way of compensation; a declaration that the complainant is entitled to a specified amount by way of reimbursement Note that under clause 97, a determination made by the Commissioner under the provisions of this Bill, or an adjudicator under an approved privacy code, is subject to judicial review under the Administrative Decisions (Judicial Review) Act Application of the Amended Act 4.44 Note that under clause 54, the amended Privacy Act 1988 would apply to the collection of personal information by an organisation only if the information is collected for inclusion in a record, or is held by the organisation in a record As stated above, the proposed Privacy Amendment (Private Sector) Bill 2000 has been presented and read a first time, and it is not yet clear whether or not the Bill will proceed to be enacted. The Human Genetics Society of Australaisia: Privacy Implications of Genetic Testing 4.46 In March 1999, the Human Genetics Society of Australasia (HGSA) issued a short set of guidelines on genetic testing and privacy. The guidelines distinguish between three categories of genetic testing: diagnostic testing, for the benefit of a person who is already symptomatic or for whom treatment is required; carrier testing, where the implications are usually for reproductive choices; and predictive testing, where the test predicts the onset of a disease at some future time The HGSA considers that in cases of diagnostic genetic testing, the situation is comparable to other types of diagnostic testing and, as such, the information should usually be shared freely between relevant health professionals involved in the individual s care. However, as the results of predictive or carrier tests relate to healthy individuals, they will not have a comparable health care team and, accordingly, disclosing predictive or carrier test results to other health professionals will usually require the patient s consent. Access to Test Results 4.48 The HGSA recommends that the level of access to genetic test results should depend on the relationship between the person tested and the person seeking the information. Specifically, the HGSA believes that predictive test results should not be divulged to any third party without the written authorisation of the individual, e.g. employers and insurers. However, less access restriction is needed for the current spouse or partner. 58

62 Where the person seeking to access the information is a blood relative who may share the same gene mutation, each situation should be assessed individually In each situation it will be necessary to balance the duty to maintain patient confidentiality (and the patient s autonomy not to disclose the information), against the doctor s duty to inform other family members whose health may be at risk of harm if their status is not disclosed. The HGSA suggest that in cases where an inherited disorder in the family may result in serious illness or shortened survival, the ethical duty of care owed by a doctor to his patient may need to extend to the family group. Ownership of Test Results 4.50 The HGSA proposes that information about a gene mutation in a family derived from a genetic test should belong to all blood members of the family, whilst results of tests specific to an individual are confidential. The HGSA states, somewhat unhelpfully, that it is the challenge of the clinician and the genetic counsellor to find a way of making blood relatives aware of their risk without breaking the patient s confidence. CANADA 4.51 Prior to the enactment of the Personal Information Protection and Electronic Documents Act 2000, which is not yet in force, no federal legislation protected personal information in the private sector, as the federal Privacy Act applies only to the public sector. However, in Canada, a voluntary private sector privacy code has been in place for three years. A Canadian Standards Association (CSA) committee comprising consumer, business, government and labour representatives developed the code entitled the Model Code for the Protection of Personal Information. The Personal Information Protection and Electronic Documents Act incorporates the CSA Code, which is appended as schedule 1 of the Act. The Personal Information Protection and Electronic Documents Act The Personal Information Protection and Electronic Documents Act was introduced as Bill C-6 in 1999 and received assent on 13 April The Act introduces measures to protect personal information in the private sector After passing first reading in the Senate in early November 1999, the Bill was subsequently referred to the Standing Senate Committee on Social Affairs, Science and Technology. The Committee s hearing focussed mainly on concerns regarding Part 1 of the bill, which applies to personal health information. The Committee recommended that the Bill be amended to delay the application of the Bill to personal health information for one year following the coming into force of Part 1 of the bill. 235 The Committee s amendments (indicated below by bold type) were passed by the Senate, and subsequently by the House of Commons, and the amended Bill received assent on 13 April Part 1 of the Act will come into force on 1 January Thus, in light of the Committee s recommendations, the new Act will not apply to personal health information until 1 January Although the Act contains six parts, the most prominent is Part1: Protection of Personal Information in the Private Sector. Part 1 establishes a right to the protection of personal information collected, used or disclosed in the course of commercial activities in connection with the operation of a federal work, undertaking or business, both 235 The Standing Senate Committee on Social Affairs, Science and Technology (6 December 1999). 59

63 interprovincially and internationally. The following principles are established to govern the collection, use and disclosure of personal information: accountability; identifying the purpose for the collection of personal information; obtaining consent; limiting collection; limiting use, disclosure and retention; ensuring accuracy; providing adequate security; making information management policies readily available; providing individuals with access to information about themselves; and giving individuals a right to challenge an organisation s compliance with these principles. Purpose 4.56 Section 3 states that the purpose of Part 1 is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognises the right of privacy of individuals with respect to their personal information and the need of organisations to collect, use and disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances Thus, the Act aims to achieve a balance between the right of individuals to the privacy and security of their information against the reasonable needs of organisations for information in today s high technology and information-based economy. Section 3 also requires that the purposes for which information is collected, used, or disclosed be limited to those that a reasonable person would consider appropriate in the circumstances. This reasonable purposes limitation is also found in section 5(3), although it is not explicitly defined in the Act. Definitions 4.58 The most notable definitions in section 2 are commercial activity, organisation and personal information. Commercial activity means any particular transaction, act or conduct, or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists. The definition of organisation is inclusive, and includes an association, a partnership, a person and a trade union. Personal information means information about an identifiable individual, but does not include the name, title, or business address or telephone number of an employee of an organisation In its Report, the Standing Senate Committee on Social Affairs, Science and Technology recommended that Bill C-6 be amended to add a new definition, personal health information, to clause 2 of the bill. 60

64 4.60 This amendment was passed in the House of Commons and the Senate so that personal health information is now defined, with respect to an individual, whether living or deceased, as: information concerning the physical or mental health of the individual; information concerning any health service provided to the individual; information concerning the donation by the person of any body part or bodily substance of the individual, or information derived from the testing or examination of a body part or bodily substance of the individual; information that is collected in the course of providing health services to the individual; or information that is collected incidentally to the provision of health services to the individual. Application of Part Pursuant to section 4(1), Part 1 of the Act will apply to organisations in relation to personal information that they collect, use or disclose: in the course of commercial activities, or where the personal information is about an employee of the organisation, and in connection with the operation of a federal work, undertaking or business However, pursuant to section 4(2), Part 1 does not apply: to any government institution to which the Privacy Act applies; to personal information collected, used or disclosed by an individual exclusively for domestic purposes; or to any organisation in respect of personal information that is collected, used or disclosed for journalistic, artistic or literary purposes, and not collected, used or disclosed for any other purpose. Protection of Personal Information 4.63 Section 7 is a key provision of Part 1, as it sets out the exemptions pursuant to which an organisation is permitted to collect, use, or disclose personal information without the knowledge or consent of the individual to whom it relates. Collection without knowledge or consent is permissible if: the collection is clearly in the interests of the individual, and consent cannot be obtained in a timely way; it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or accuracy of the information, and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province; the collection is solely for journalistic, artistic or literary purposes; or 61

65 the information is publicly available and is specified by the regulations As regards the use of personal information without the knowledge or consent of the individual concerned, section 7(2) provides that such use is only permissible if: the organisation has reasonable grounds to believe it could be useful in an investigation of a contravention of the laws of Canada, or a foreign jurisdiction; it is used for the purpose of acting in an emergency that threatens the life, health or security of an individual; it is used for statistical or scholarly study or research purposes that cannot be achieved without using the information, and the information is used in a manner that will ensure its confidentiality, and it is impracticable to obtain consent. The organisation must also inform the Commissioner of the use before the information is used; it is publicly available and is specified by the regulations; or it was collected under paragraph 1(a) or (b) (i.e. in the interests of the individual where consent cannot be obtained, or for purposes relating to a contravention of the laws of Canada) However, section 7 also sets out an extensive list of situations in which disclosure without the knowledge or consent of the individual to whom the information relates is authorised. Disclosure without consent is authorised if the disclosure is: made to legal counsel representing the organisation; for the purpose of collecting a debt owed to the organisation by the individual; required to comply with a subpoena or warrant issued or an order made by a court, person or body that has jurisdiction to compel the production of information, or to comply with the rules of the court relating to the production of records; to a government institution or part of a government institution that has requested the information, identified its lawful authority to obtain the information, and indicated that: (i) it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs, (ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province, or a foreign jurisdiction; carrying out an investigation relating to the enforcement of any such law; or for gathering intelligence for the purpose of enforcing any such law, or (iii) the disclosure is necessary for the purpose of administering any law of Canada or a province; made on the initiative of the organisation to the investigative body, and the organisation: (i) has reasonable grounds to believe that the information relates to a breach of an agreement or a contravention of the laws of Canada, a province or a foreign jurisdiction that has been, is being, or is about to be committed, or (ii) suspects that the information relates to national security, the defence of Canada or the conduct of international affairs; made to a person who needs the information because of an emergency that threatens the life, health or security of an individual and, if the individual the 62

66 information is about is alive, the organisation informed that individual, in writing and without delay, of the disclosure; for statistical or scholarly study or research purposes (the conditions for which are described below in para 4.66); made to an institution whose functions include the conservation of records of historic or archival importance and the disclosure is made for such purposes; made after either 100 years after the creation of the record containing the information, or 20 years after the death of the individual the information is about, whichever date is earlier; of information that is publicly available and is specified by the regulations; made by an investigative body and disclosure is reasonable for purposes related to an investigation of a breach of an agreement or a contravention of the laws of Canada or a province; required by law Section 7(2)(c) contains the conditions attached to the exemption for statistical or scholarly study or research purposes. Firstly, it must be impossible to achieve the purposes of the research without using the information. Secondly, the information must be used in a manner that ensures its confidentiality. Thirdly, it must also be impracticable to obtain consent, and the organisation must inform the Commissioner of the use before the information is used. One Year Exemption for Personal Health Information 4.67 The Standing Committee recommended that clause 30 of the bill was amended. A new clause, 30(1.1), would provide that Part 1 would not apply to any organisation in respect of personal health information that it collected, used or disclosed. Under a second new clause, 30(2.1), clause 30(1.1) would cease to have effect one year after the day clause 30 came into effect. The Senate and the House of Commons passed these amendments. Accordingly, under section 30(2.1), the exemption for personal health information will expire on 1 January Schedule Schedule 1 incorporates the Canadian Standards Association s voluntary code on privacy in the private sector. It consists in ten overarching principles Most of the clauses in Schedule 1 contain the word shall, thereby imposing an obligation. Other clauses, however, contain the word should, reflecting the fact that the CSA Code was originally drafted to provide voluntary, rather than legally mandated, standards. The provisions containing should or wording such as organisations are encouraged to were intended to provide best practices guidance. Bill C Bill C-6 was preceded by Bill C-54, which died on the order paper when Parliament was prorogued in September However, a number of amendments were made to Bill C- 54 at committee stage. 237 Prior to the amendments in the second session, Bill C-6 was 236 See above, para The House of Commons Standing Committee on Industry. 63

67 identical in content to Bill C-54, as amended by the standing committee on industry. Thus, it will be useful to note some of the key amendments to Bill C-54 adopted by that committee The committee held several hearings on Bill C-54. Witnesses included representatives from public interest groups, historical and archival associations, the Canadian Standards Association, the Canadian Bar Association, privacy and constitutional experts, journalists and writers groups, and health sector groups. Witnesses from the business sector included representatives from the banking, insurance, credit reporting, telecommunications, and information technology industries, and employer and employee associations. A number of significant amendments were made by the committee to the provisions in Part 1, the most notable of which are set out below. Definitions 4.72 Prior to committee review, the definition of personal information in Bill C-54 read as: personal information means information about an identifiable individual that is recorded in any form. The definition was amended to read: personal information means information about an identifiable individual but does not include the name, title or business address or telephone number of an employee of an organisation The deletion of the words that is recorded in any form could be interpreted as having the effect of broadening the scope of personal information to include information that is not in any recorded from, such as DNA or biological samples. Exemptions 4.74 Prior to the committee review of Bill C-54, clause 7(1)(b) provided an exemption from the requirement to obtain an individual s consent for the collection of personal information if it is reasonable to expect that the collection from the individual would compromise the accuracy of the information or defeat the purpose or prejudice the use for which the information is collected After some witnesses submitted that this clause left a gaping hole in the legislation, the clause was amended and its scope narrowed. Under the amended provision, an exemption would only be available if it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province As amended, clause 7(1)(b) would provide an exemption where it was necessary to collect personal information without informing the individual concerned, for example, in the circumstance of fraudulent activity. Witnesses representing insurance groups expressed concern about the effect the amendment to this, and other related clauses, could have on their ability to combat insurance fraud With regard to the exemptions for use and disclosure for statistical or scholarly study or research purposes, an amendment provided a new condition whereby the exemption would only be available if the purposes could not be achieved without using or disclosing the information. Other Amendments 4.78 Schedule 1 did not limit the purposes for which organisations can collect, use or disclose information. A purposes limitation clause, 5(3), was added to specify that an 64

68 organisation would be able to collect, use or disclose personal information only for the purposes that a reasonable person would consider are appropriate in the circumstances The Canadian Medical Association continues to request that the bill be strengthened in order to protect the privacy of health information, while some other health organisations (e.g. the Canadian Healthcare Association and the Canadian Pharmacists Association) are concerned that the bill as it stands would impede the collection of health information. They would prefer the bill to be amended so that it does not apply to health information. The Personal Health Information Act 1997 (Manitoba) 4.80 The Manitoba Personal Health Information Act came into force on 17 December The act applies to all those who have custody and control of personal health information, the trustees of the information. For the purpose of the Act, "trustee means a health professional, health care facility, public body, or health services agency that collects or maintains personal health information. The act regulates the nature and amount of information that can be collected, used or disclosed by a trustee The Act applies to recorded personal health information about individuals who can be identified. It does not apply to anonymous or statistical health information that does not permit individuals to be identified, either by itself or when combined with other information available to the holder. Thus, for the purpose of the Act, personal health information means recorded information about an identifiable individual that relates to the individual s health, or health care history, including genetic information about the individual. Accordingly, no distinction is made between genetic information and other medical information. Access to Personal Health Information 4.82 Part 2 of the Act contains the provisions which govern access to personal health information Section 5(1) states that an individual has a right, on request, to examine and receive a copy of his or her personal health information maintained by a trustee. However, under s.11(1) a trustee is not required to permit an individual to examine or copy his or her personal health information if: knowledge of the information could reasonably be expected to endanger the mental or physical health or the safety of the individual or another person; disclosure of the information would reveal personal health information about another person who has not consented to the disclosure (particularly significant as regards genetic information given that it may reveal health information about blood relatives); or the information was compiled principally in anticipation of, or for use in, a civil, criminal or quasi-judicial proceeding. Protection of Privacy 4.84 Division 1 of Part 3 of the Act contains restrictions on the collection and retention of an individual s personal health information. Section 13(1) stipulates that a trustee shall not collect personal health information about an individual unless the information is collected for a lawful purpose connected with a function or activity of the trustee, and the collection of the information is necessary for that purpose. Furthermore, a trustee is only permitted to collect as much information as is needed for the purpose for which it is collected. 65

69 4.85 Trustees must have, and comply with, a written policy concerning the retention and destruction of personal health information. 238 Security Safeguards 4.86 Under the provisions of Division 2, trustees of personal health information must ensure that there are adequate security safeguards in place to protect the data they have collected Section 18(1) provides that a trustee must protect personal health information by adopting reasonable administrative, technical and physical safeguards that ensure the confidentiality, security, accuracy and integrity of the information. Restrictions on Use and Disclosure of Information 4.88 Section 20(1) of Division 3 prohibits the use or disclosure of personal health information, except as authorised under this Division. Essentially, use and disclosure must be restricted to the minimum amount necessary to accomplish the purpose for which it is used or disclosed. Moreover, a trustee may only use personal health information for the purpose(s) for which it was collected or received. 239 There are some limited exceptions to this general principle, namely, if: the other purpose is directly related to the purpose for which the personal health information was collected and received; the individual to whom the personal health information relates has consented to the use; or use of the information is necessary to prevent or lessen a serious and immediate threat (i) to the mental or physical health or safety of the individual to whom the information relates or another individual; or (ii) public health or public safety Section 22(1) contains a similar restriction on the disclosure of information by trustees. Generally, a trustee may only disclose personal health information if (i) the disclosure is to the person to whom the information relates, or to his or her representative, or (ii) the individual the information concerns has consented to the disclosure. However, s.22(2) specifies certain circumstances in which a trustee may disclose personal health information without the relevant individual s consent. Pursuant to subsection 22(2), disclosure without consent is authorised if such disclosure is: to a person who is/has provided health care to the individual, to the extent necessary to provide health care to the individual, unless the individual has instructed the trustee not to make the disclosure; to any person if the trustee reasonably believes the disclosure is necessary to prevent/lessen a serious and immediate threat to the mental or physical health of any individual, or public health and safety; for the purpose of: (i) contacting a relative or friend of a person who is injured, incapacitated or ill; 238 Personal Health Information Act (Manitoba) 1997, s.17(1). 239 Personal Health Information Act (Manitoba) 1997, s

70 (ii) assisting in identifying a deceased individual; or (iii) informing the representative or a relative of a deceased individual, or any other person it is reasonable to inform in the circumstances, of the individual s death; to a relative of a deceased individual if the trustee reasonably believes that disclosure is not an unreasonable invasion of the deceased s privacy; in accordance with section 23 (disclosure to patient s family), 240 section 24 (disclosure for health research), 241 or section 25 (disclosure to an information manager); to a computerised health information network and database established by the government or another trustee that is a public body specified in the regulations, in which personal health information is recorded for the purpose of facilitating; (i) the delivery, evaluation or monitoring of a programme that relates to the provision of health care or payment for health care, or (ii) research and planning that relates to the provision of health care or payment of health care; required in anticipation of, or for use in, a civil or quasi-judicial proceeding to which the trustee is a party, or for the prosecution of an offence; required to comply with a subpoena, warrant or order issued or made by a court, person or body with jurisdiction to compel the production of the personal health information, or with a court ruling concerning the production of the personal health information; for the purpose of: (i) an investigation under, or the enforcement of, an enactment of Manitoba respecting payment for health care; or (ii) an investigation or enforcement respecting a fraud relating to payment for health care. for the purpose of complying with an arrangement or agreement entered into under an enactment of Manitoba or Canada; or authorised or required by an enactment of Manitoba or Canada In all the above circumstances, a trustee may disclose information only to the extent that the recipient needs to know the information. 242 Disclosure for Health Research 4.91 Section 24(1) of the Act provides that a trustee may disclose personal health information to a person conducting a health research project, but only if the project has been approved under this section. If the health information is maintained by the government or a government agency, approval may be given by the health information privacy committee established under section 59. If the information is maintained by a non-government trustee, approval may be given by an institutional research review committee In each case, approval may only be given if the committee has determined that the proposed research project satisfies the criteria set out in s.24(3). Firstly, the research must 240 Disclosure is authorised under s.23(1) if the individual is a patient or resident in a health care facility and disclosure is about health care currently being provided; is made in accordance with good professional practice; and the trustee reasonably believes disclosure to be acceptable to the individual. 241 See below, para Personal Health Information Act (Manitoba) 1997, s.22(3). 67

71 be of sufficient importance to outweigh the intrusion into an individual s privacy that would result from the disclosure of their personal health information. Secondly, the research purpose must be not reasonably accomplishable unless the personal health information is provided in a form that identifies or may identify individuals. Thirdly, it must be unreasonable or impractical for the researcher to obtain consent from the individuals to whom the personal health information relates. Moreover, the research proposal must incorporate reasonable safeguards to protect the confidentiality and security of the personal health information, as well as procedures to destroy the information or remove all the identifying information at the earliest opportunity consistent with the purposes of the project Under s.24(5), if a research project will require direct contact with individuals, a trustee must not disclose personal health information about those individuals without first obtaining their consent. However, the trustee need not obtain their consent if the information consists only in the individuals names and addresses. Miscellaneous Requirements 4.94 Section 27(1) of the Act prohibits trustees from selling or otherwise disposing of personal health information, except where (i) it is essential to facilitate the sale or disposition of the practice of a health professional or the business of a health care facility or health services agency as an ongoing concern; and (ii) subject to subsection (2) (exception for pharmacies in compliance with The Pharmaceutical Act), the sale or disposition is to another trustee. Complaints 4.95 Section 39(1) provides that an individual may make a complaint to the ombudsman about trustees restricting the individual s access to his information. Section 39(2) provides a right to make a complaint about the privacy of information The provincial ombudsman has responsibility for overseeing compliance with the act. USA 4.97 There is currently no comprehensive federal legislation that protects the right to privacy of individually identifiable health care information in the USA. Instead, there is a complex patchwork of federal and state protections, providing varying degrees of protection. 243 Indeed, the Secretary of Health and Human Services has stated that right now, the way [the USA] currently protects the privacy of [its] medical records is erratic at best dangerous at worst. It is time for [the USA] to enact federal legislation to protect the age-old right to privacy in this new world of progress At a federal level, limited protection is provided by: the constitutional right to privacy the Privacy Act P, I. Carter, Health Information Privacy: Can Congress Protect Confidential Medical Information in the Information Age (1999) 25 William Mitchell L. Rev. 223, p Confidentiality of Individually Identifiable Health Information: Recommendations of the Secretary of State of Health and Human Services (1997), cited in P, I. Carter, Health Information Privacy: Can Congress Protect Confidential Medical Information in the Information Age (1999) 25 William Mitchell L. Rev. 223, p

72 the Americans With Disabilities Act At state level, the common law provides for a variety of claims related to breaches of confidentiality, and, in addition, more than a dozen states have adopted constitutional amendments designed to protect privacy interests. However, there is significant variation from state to state in terms of the nature and quality of legislation regarding confidentiality of medical information Given the erratic nature of US data protection, and the fact that it is based largely on constitutional principles that do not apply to the UK, it is neither appropriate nor particularly useful to consider the protections in detail here. However, for a comprehensive analysis of both federal and state data protections, see: P, I. Carter, Health Information Privacy: Can Congress Protect Confidential Medical Information in the Information Age (1999) 25 William Mitchell L. Rev GERMANY Data protection in Germany is provided by the Federal Data Protection Act 1990, which is intended to protect individuals right to privacy from being impaired through the handling of their personal data. 246 The Act applies to the collection, processing and use of personal data by public bodies, and also private bodies insofar as they process or use data in or from data files for business, professional, or commercial purposes For the purposes of the Act, personal data means any information concerning the personal or material circumstances of an identified or identifiable individual (the data subject), 248 and is thus sufficiently broad to encompass genetic information. Data processing means the storage, modification, communication, blocking and erasure of personal data. 249 Under section 4 of the Act, processing and using personal data is only permissible to the extent that it is authorised by the Act or another legal provision, or if the data subject has consented. Consent should be given in writing. Data Processing by Public Bodies Part II of the Act contains the provisions governing data processing and the use of personal information by public bodies of the Federation which do not participate in competition as public-law enterprises Public bodies of the Federation include the authorities or bodies of the judicature and other public law institutions of the Federation, as well as their associations irrespective of their legal structure Public bodies of the Lander include the authorities or bodies of the judicature and other public law institutions of a Land or municipality, or other legal persons under public law subject to Land supervision, as well as their associations irrespective of their legal structure. 251 Collection of Data 245 P, I. Carter, Health Information Privacy: Can Congress Protect Confidential Medical Information in the Information Age (1999) 25 William Mitchell L. Rev. 223, pp.246 and Federal Data Protection Act 1990, s.1(1). 247 Federal Data Protection Act 1990, s.1(2). 248 Federal Data Protection Act 1990, s.3(1). 249 Federal Data Protection Act 1990, s.3(5). 250 Federal Data Protection Act 1990, s.2(1). 251 Federal Data Protection Act 1990, s.2(2). 69

73 4.106 Section 13 regulates the collection of data by public bodies. Firstly, it provides that public bodies may only collect personal data if it is required to enable them to perform their duties. Secondly, it specifies that personal data should normally be collected from the data subject. In such circumstances, the data subject must be informed of the purpose of the collection. However, personal data may be collected without the subject s participation, but only if: it is required by law; the nature of the duty to be performed necessitates collection of the data from other persons or bodies; or collection of the data from the data subject would require disproportionate effort and there is nothing to suggest that the (undefined) overriding legitimate interests of the data subject are impaired. 252 Storage, Modification and Use of Data In general, storage, modification or use of personal data by public bodies is only permissible if it is necessary for the performance of the duties of the data controller, or if it serves the purpose for which it was collected. 253 However, the Act provides other specified circumstances in which personal data may be stored, modified or used for purposes other than those for which it was collected. Accordingly, storage, modification or use for other purposes is only permissible to the extent that: it is required by law; the data subject has consented; it is evident it would be in the interests of the data subject and there is no reason to assume s/he would withhold consent if s/he knew of the other purpose; the data has to be checked because there are actual indications that it is incorrect; the data derives from generally available sources; it is necessary to avert an immediate threat to public safety; it is necessary to prosecute criminal or administrative offences; it is necessary to avert a grave infringement of another person s rights; or it is necessary for the conduct of scientific research, and the scientific interest in the research project substantially outweighs the interest of the data subject in preventing the change of purpose, and the research purpose cannot be attained by other means or can be attained thus only with disproportionate effort. 254 Disclosure of Personal Information The Act deals with disclosure of information by public bodies under three separate heads: (i) communication of data to public bodies; 255 (ii) communication of data to private bodies; Federal Data Protection Act 1990, s.13(2). 253 Federal Data Protection Act 1990, s.14(1). 254 Federal Data Protection Act 1990, s.14(2). 255 Federal Data Protection Act 1990, s Federal Data Protection Act 1990, s

74 (iii) communication of data to bodies outside the application of the Act As regards the communication of data to public bodies, the Act provides that this shall be permissible if it is necessary for the performance of the duties of the communicating body or the recipient, and the requirements of section 14 are met. 258 In terms of disclosure of information to private bodies, communication is permissible if it is necessary for the performance of the duties of the communicating body and the requirements of s.14 are met, or if the recipient proves a credible and justified interest in the data. However, the latter is not permissible if the data subject has a legitimate interest in excluding the communication. The circumstances in which it may be permissible to disclose information to a body outside the application of the Act are the same as those that apply in cases of disclosure to private bodies, except that communication shall not occur where there is reason to assume this would be incompatible with a German law. In all cases of communication, the responsibility for the permissibility of the communication lies with the communicating body, except if the body requesting the information is another public body, in which case, they will assume responsibility. In all cases, the recipient of the data may only process or use it for the purpose for which it was communicated. Rights of the Data Subject Sections 19 to 21 specify the rights of data subjects Firstly, s.19 provides that the data subject is entitled to request information about stored data relating to him, including any information regarding the origin or recipients of the data, and the purpose for which the data is being stored. Under s.6, the right to information is an inalienable right and may not be restricted or excluded by a legal transaction. However, information does not have to be provided to the data subject if this would be prejudicial to the proper performance of the duties of the data controller, or if the data or the fact that it is being stored must be kept secret in accordance with a legal provision, or on account of an (undefined) overriding interest of a third party Secondly, a data subject has the right to correction, erasure and blocking of data in certain specified circumstances. Again, this right cannot be restricted or excluded by a legal transaction in accordance with s.6 of the Act Section 20(1) states that incorrect personal data must be corrected. If the data subject disputes the correctness of data held in records, a note to this effect should be included in the record. Subsection 20(2) specifies that personal data in data files must be erased if their storage is not permitted under the provisions of the Act, or if they are no longer required by the data controller to perform his duties. In certain circumstances, personal data may be blocked as opposed to erased, under the provisions of subsection 20(3). Blocking means labelling stored personal data so as to restrict further processing or use, 260 and should be applied where statutory or contractual provisions prohibit erasure, where erasure might impair the (undefined) legitimate interests of the data subject, or where erasure is not possible or would require disproportionate effort due to the particular type of storage. Personal data in files should also be blocked if the data subject disputes that the information is correct and it cannot be ascertained whether they are correct or not, 261 or if legitimate interests of the data subject would otherwise be impaired and the information is no longer 257 Federal Data Protection Act 1990, s See above, para Federal Data Protection Act 1990, s.19(4). 260 Federal Data Protection Act 1990, s.3(5) Federal Data Protection Act 1990, s.20(4). 71

75 required for performance of the authority s duties. 262 Notwithstanding, blocked data may be disclosed or used without the consent of the data subject: if this is indispensable for scientific purposes; for use as evidence or other reasons in the (undefined) overriding interests of the data controller or a third party; and communication or use of the data for this purpose would be permissible if the data were not blocked The third right of data subjects, provided by s.21, is that anyone may appeal to the Federal Commissioner for Data Protection if he believes his rights have been infringed through the collection, processing or use of his personal data by public bodies of the Federation. Data Processing by Private Bodies and Public Law Enterprises Participating in Competition Part III of the Act applies to processing and use of personal data (in or from data files) in the normal course of business, or for professional or commercial purposes by: private bodies, defined as natural or legal persons, companies and other private law associations; 264 public bodies of the Federation or the Lander insofar as they participate in competition as public law enterprises. 265 Storage, Communication and Use of Data for Own Purposes Under the terms of section 28, it seems that the storage, communication, modification, or use of personal data by private bodies as a means of fulfilling their own business purposes would not extend to the use of genetic information for such other purposes, unless such use was in accordance with the purposes of a contract of quasicontractual fiduciary relationship with the data subject. 266 Firstly, such use is only permissible if the data can be obtained from generally accessible sources. 267 Secondly, subsection 28(2)1(b) states that it can generally be assumed that the data subject has a legitimate interest in excluding communication of personal information which was stored for the purposes of a contract or a quasi-contractual fiduciary relationship and which concerns, inter alia, health matters There is an exception, however, where the personal information is necessary for scientific research, if scientific interest in the research outweighs the interest of the individual in excluding the change of purpose, and if the research purpose cannot be attained by other means or can be attained thus only with disproportionate effort. 268 Storage of Data in the Normal Course of Business for the Purpose of Communication Section 29, which provides for the storage or modification of personal data in the normal course of business for the purpose of communication, is also unlikely to extend to 262 Federal Data Protection Act 1990, s.20(5). 263 Federal Data Protection Act 1990, s.20(6). 264 Federal Data Protection Act 1990, s.2(4). 265 Federal Data Protection Act 1990, s.27(1). 266 Federal Data Protection Act 1990, s.28(1) Federal Data Protection Act 1990, s.28(1) Federal Data Protection Act 1990, ss.28(1)4 and 28(2)2. 72

76 genetic information, as it is only permissible if there is no reason to assume the data subject has a legitimate interest in excluding his data from storage or modification in the normal course of business, or the data can be taken from generally accessible sources. Rights of the Data Subject As in the case of data subjects whose information is stored by public bodies, data subjects whose information is stored by private bodies are also conferred certain rights under the Act The first of these is the right to notification. 269 When personal data is stored for the first time for private bodies own purposes, the data subject should be notified of such storage, and of the type of data being stored. However, notification is not required if the data subject is already aware of the storage or communication of the data Secondly, the data subject has the right to request information about the stored data concerning him, including any reference to the origin or recipients of the information, the purpose of the storage, and persons or bodies to whom his data is regularly communicated Thirdly, personal data shall be corrected, erased or blocked in certain circumstances provided for in s.35. Incorrect personal data must be corrected. Unless erasure is prohibited by preservation periods provided by law, statute or contract, personal data must be erased if storage is not permissible under the Act, or if they relate to health matters and the data controller cannot prove they are correct. 271 As in the case of data held by public bodies, data must be blocked if the data subject disputes the accuracy of the data and it cannot be ascertained whether it is correct or not. However, as genetic information relates to health matters, in such circumstances it would have to be erased in accordance with s.35(2)2 as opposed to merely being blocked. Processing and Use of Personal Data by Research Institutes The Act contains specific provisions regarding the processing and use of personal data by research institutes. Section 40(1) provides that personal data collected or stored for scientific research purposes may only be processed or used for such purposes. Furthermore, under subsection 40(3), the personal data must be depersonalised as soon as the research purpose permits this. Until such time, information concerning personal or material circumstances that enable the information to be attributed to an identified or identifiable individual must be stored separately. Remedies The Act provides data subjects with a claim to compensation from both public and private bodies. If a public body causes harm to the data subject through automated processing of his personal data that is either inadmissible or incorrect under the terms of the Act, such body is obliged to compensate the data subject for the harm thus caused, irrespective of fault. In cases of serious violations of privacy, the data subject is entitled to adequate pecuniary compensation for the immaterial harm caused. The total amount of compensation payable is DM 250, Federal Data Protection Act 1990, s Federal Data Protection Act 1990, s Federal Data Protection Act 1990, s.35(2)2. 73

77 4.125 With regard to claims against private bodies, if it is disputed whether the harm caused results from a circumstance for which the data controller is responsible, the burden of proof lies with the data controller. The German Society of Human Genetics: Position Paper The Position Paper of the German Society of Human Genetics (GfH), 272 published in 1996, emphasises the importance of the principle of confidentiality. The nature of genetic information is such that it is generally significant to the health, life and reproductive plans not only of the person affected, but also their family and relatives. Accordingly, the GfH states that genetic data should not be generally accessible, and must be particularly protected from third party inquiry and interest. 273 Genetic data should only be passed on when the individual has been fully informed of the usefulness and purpose of communicating the data, and has given written permission for the data to be released. Thus, the GfH advise that a medical geneticist must only release data if the patient expressly addresses a request for release of data to him, if the purpose of releasing the data is defined, and if the physician is satisfied that the patient is aware of all the possible consequences of releasing the data The GfH recognises that these obligations go beyond the general concept of confidentiality in medical practice, and that they may sometimes conflict with the medical tenet to prevent harm and suffering to a third party. This conflict will arise particularly if the genetic data is relevant to other family members health and could lead to preventative medical treatment. The GfH advise that in such circumstances, no matter what the physician does, important ethical principles will be compromised. Thus, there can be no general rules about what should be done in these circumstances; rather, each case should be considered individually, involving as many of the parties concerned as possible. However, if the condition is neither treatable nor preventable, the right to self-determination concerning genetic information must take precedence over the interests of third parties in obtaining that information. 275 SWEDEN Existing Regulation The Swedish Ministry of Health and Social Affairs has stated that there is no reason why genetic information should require special privacy protections. 276 The rationale for adopting this position is that any data obtained in the course of a genetic examination already comes under existing privacy protections, and ought in principle to be treated in the same way as other information with a sensitive bearing on personal integrity and privacy. 277 The Individual Medical Records Act When genetic testing using DNA or RNA analysis is performed at the request of the individual or in connection with medical screening, any data derived from the genetic analysis will come under the provisions of the Individual Medical Records Act This means that the data will be entered in the individual s medical record. 272 Deutsche Gesellschaft fur Humangenetik e.v., Position Paper of the German Society of Human Genetics (1996). 273 Position Paper of the German Society of Human Genetics (1996), p.a Position Paper of the German Society of Human Genetics (1996), p.a Id. 276 Ministry of Health and Social Affairs, Swedish Act Concerning Use of Gene Technology on Human Beings 1991 (English Summary), p Id. 74

78 4.130 In principle, the individual has a right of access to his or her medical record. 278 Moreover, like other medical information, genetic data held in an individual s medical record may not in principle be divulged to third parties such as employers or insurance companies without the person s consent Data entered in records kept by public health and medical services come within the Secrecy Act 1980, specifically the provisions contained in Chapter 7 of the Act. Data in an individual medical record kept outside the public health and medical sector comes under the Act concerning the supervision of health and medical personnel and others (the Supervision Act) The result is that the data are subject to the secrecy applying to health and medical care If genetic data is to be used for purposes other than the needs of the individual himself (e.g. it is to be used in the planning of medical services), then the individual s consent must be obtained. The physician must explain to the individual as clearly as possible the implications and possible consequences of disclosing the data before it is divulged. Furthermore, information used for the purpose of medical planning and so forth is usually deidentified The Swedish Ministry of Health and Social Affairs consider that these protections adequately protect genetic information from potential misuse. However, the National Board of Health and Welfare is tasked with monitoring developments in the treatment of genetic information. It is able to raise the question of supplementing existing safeguards through legislation or other means if it considers such measures would be appropriate, though, as yet, it has not done so. 281 THE NETHERLANDS The Personal Data Protection Act Data protection in the Netherlands is provided by the Personal Data Protection Act For the purposes of the Act, personal data refers to any information relating to an identified or identifiable natural person, and processing of personal data means any operation concerning personal data, including the collection, recording, storage, updating and modification, retrieval, use, distribution, linking, blocking, erasure or destruction of data. 282 Processing of Health Information Part 2 of the Act contains provisions which apply to the processing of special personal data. Under section 16, it is prohibited to process personal data concerning a person s health. However, section 21 contains several exceptions to this general prohibition. Accordingly, personal data concerning a person s health may be processed where the processing is carried out by: medical professionals, health care institutions or facilities, or social services, provided it is necessary for the proper treatment and care of the data subject, or for the administration of the institution concerned; 278 Id., p Id. 280 Id., pp Id.,p Personal Data Protection Act 2000, s.1. 75

79 insurance companies (although note the restrictions contained in the Medical Checks Act 1997), 283 provided that this is necessary for (i) risk assessment, and the data subject has not indicated any objection thereto, or (ii) the performance of the insurance contract; schools, provided this is necessary to provide special support or make special arrangements for pupils in connection with their health; administrative bodies, pensions funds, or employers (again, note the provisions of the Medical Checks Act 1997), 284 provided this is necessary for (i) the proper implementation of legal provisions or regulations which create rights dependent on the health of the individual, or (ii) the reintegration of or support of workers entitled to benefit in connection with sickness or work incapacity In any of the above instances, personal health data may only be processed by persons subject to an existing obligation of confidentiality (e.g. by virtue of office or profession). Persons not already subject to such an obligation are required under subsection 21(2) to treat the data as confidential, and may not disclose it to third parties, except where disclosure is required by law Moreover, the Act specifically provides that data concerning inherited characteristics may only be processed where the processing takes place with respect to the data subject, unless: a serious medical interest prevails, or the processing is necessary for the purpose of scientific research or statistics Under section 23, the scientific research must serve the public interest; the processing must be necessary for the research or statistics concerned; it must appear impossible, or involve a disproportionate effort, to ask for express consent; and sufficient guarantees must be provided to ensure that the data subject s privacy is not adversely affected to a disproportionate extent. Information to be Provided to the Data Subject Prior to obtaining personal data about an individual, the responsible party must provide the data subject with certain specified information, including the identity of the responsible party and the purposes of the processing for which the data is intended. 287 More detailed information must be provided if the nature of the data, or the use to be made thereof, is such that this is necessary to guarantee, with respect to the data subject, that the processing is carried out in a proper and careful manner. 288 Rights of the Data Subject The Act provides data subjects with certain rights relating to the processing of personal data that concerns them. Firstly, a data subject has the right to request the responsible party to inform him as to whether personal data relating to him is being processed. If such data is being processed, the responsible party must inform the data subject in writing, within 4 weeks, of the purpose(s) of the processing, the type of data being 283 See above, para See above, para Personal Data Protection Act 2000, ss.21(1)(a),(b),(c) and (f). 286 Personal Data Protection Act 2000, s.21(4). 287 Personal Data Protection Act 2000, s.33(2). 288 Personal Data Protection Act 2000, s.33(3). 76

80 processed, the recipients of the data, as well as any available information about the origin of the data Secondly, a person who has been informed about personal data relating to him has the right to request that the data is corrected, supplemented, deleted or blocked if it is inaccurate, incomplete or irrelevant to the purpose(s) of the processing. The responsible party must inform the data subject within 4 weeks as to whether, or to what extent, the request is being complied with Where the data subject is a minor under the age of 16, or a person placed under legal restraint, the requests referred to in sections 35 and 36 must be made by their legal representative Article 41 of the Act further provides that a data subject has the right to object to data being processed in connection with the creation or maintenance of a direct relationship between the responsible party or a third party and the data subject with a view to recruitment for commercial or charitable purposes. In the event of such an objection, the responsible party must stop this form of processing with immediate effect. Legal Protection If the data subject is not happy with a decision taken by the responsible body in response to a request or objection concerning the processing of his personal data, the data subject can: apply to the district court with a written request to order the responsible party to grant the request or recognise the objection, where the decision been taken by a body other than an administrative body; 292 or apply to the Data Protection Commissioner with a request to mediate or give its opinion on the dispute, where the decision has been taken by an administrative body Where a person suffers harm (that does not comprise damage to property) as a consequence of an infringement of the Personal Data Protection Act, the injured party has the right to fair compensation. Similarly, responsible parties are liable for harm resulting from non-compliance with the Act. 294 A further remedy is provided by section 50 in that it provides that a court may ban conduct which has caused a data subject harm, and order the responsible party to remedy the consequences of such conduct. The Data Protection Commissioner The Act establishes an Office of the Data Protection Commission, which is tasked with overseeing the processing of data in accordance with the provisions of the Act. The Commission is also required to issue an opinion on Bills and draft texts which relate entirely or substantially to the processing of personal data In the event that a responsible party acts in contravention of the Act, the Commission may require them to pay an administrative fine of up to 10,000 Dutch guilder. 289 Personal Data Protection Act 2000, s Personal Data Protection Act 2000, s Personal Data Protection Act 2000, s Personal Data Protection Act 2000, s Personal Data Protection Act 2000, s Personal Data Protection Act 2000, s Personal Data Protection Act 2000, s

81 SUMMARY Data protection and privacy is a very broad category and it should be remembered that the protections considered under this head also have implications with regard to the collection, storage, and use of genetic information by employers, insurers, researchers, and other individuals and organisations Nearly all the legislation considered does not relate specifically to the protection of personal genetic data; rather, it is general data protection legislation that may nevertheless apply to the collection, storage, and use of personal genetic data. The one exception to this is the Manitoba Personal Health Information Act 1997, which explicitly states that the definition of health information includes genetic information. A further limited exception is the Dutch Personal Data Protection Act 2000, which contains a specific provision relating to the processing of data concerning inherited characteristics. Under this provision such data may only be processed with respect to the data subject, unless a serious medical interest prevails or the processing is necessary for the purpose of scientific research or statistics Not all of the legislation distinguishes between health information and other individually identifying personal information. 297 Moreover, with the limited exception of the Dutch Personal Data Protection Act, none of the legislation distinguishes between genetic information and other health information. 298 Indeed, the Swedish Ministry of Health and Social Affairs has expressly stated that there is no need to distinguish between genetic and other medical data, because data obtained from a genetic examination is already protected by existing legislation regarding the confidentiality of medical records. Interestingly, the Australian Genetic Privacy and Non-discrimination Bill 1998 contained a clause that specifically provided that an individual s general authorisation for the release of medical records (for example, to a prospective employer) would not constitute an authorisation for the disclosure of genetic information contained therein. A provision such as this is of particular relevance where the protections do not distinguish between genetic and other medical data All of the legislation specifies certain circumstances in which personal data may be used or disclosed without the individual s consent and/or knowledge. These broad exceptions include where disclosure is required by law or for use in judicial proceedings, 299 where disclosure is required to prevent or lessen a serious and immediate threat to the health and safety of the individual or others, 300 and where the disclosure is for statistical or research purposes The conditions that must be met for the use or disclosure of health information for research purposes vary from Act to Act. Generally, however, such disclosure must be necessary for the purposes of the research, it must be impracticable to obtain the individual s express consent, and the researchers must ensure that there are adequate security safeguards to protect the confidentiality of the data subject. 296 In which case: the research must serve the public interest; the processing must be necessary for the research concerned; it must be impossible, or would involve a disproportionate effort, to ask the individual for express consent; and sufficient guarantees must be provided to ensure that the data subject s privacy is not adversely affected to a disproportionate extent. 297 See the German Federal Data Protection Act Note that the Manitoba Personal Health Information Act 1997 explicitly states that health information includes genetic information. 299 See, for example, the Australian Privacy Amendment (Private Sector) Bill 2000, the Manitoba Personal Health Information Act 1997, the Canadian Personal Information Protection and Electronic Documents Act See, for example, the Australian Privacy Amendment (Private Sector) Bill 2000, the Manitoba Personal Health Information Act 1997, the Canadian Personal Information Protection and Electronic Documents Act Id. See, also, the Dutch Personal Data Protection Act

82 4.153 A particular issue of concern with regard to the privacy of genetic information (expressed by both the German Society of Human Genetics and the Australian Senate Legal and Constitutional Committee) relates to the potential conflict of duties faced by physicians who are aware that their patient is suffering from a genetic disorder or disease. The nature of genetic information is such that it not only concerns the health of the affected individual, but may also have implications for the health of the individual s family members. Accordingly, a conflict may arise between the duty of confidentiality owed to the individual, and the wider duty to prevent harm and suffering to third parties, particularly relatives. The German Society of Human Genetics (GfH) advises that there can be no general rule as which duty should take precedence. Whatever the physician does, important ethical principles will be compromised. Thus, each situation must be assessed individually. However, the GfH does state that if the condition is neither treatable nor preventable, the individual s right to selfdetermination and autonomy must prevail over the interests of the third party. 79

83 FORENSICS 302 AUSTRALIA 5.1 In Australia, there are a range of Acts at State level which contain forensic procedure provisions affecting the collection, storage, analysis and disclosure of genetic information. 303 At a Federal level, the Commonwealth Parliament assented to the Crimes Amendment (Forensic Procedures) Act 1998 (Cth) on 23 July The Crimes Amendment (Forensic Procedures) Act The Act introduces into the Crimes Act 1914 (Cth) the model provisions developed by the Model Criminal Code Officers Committee, and also incorporates a number of recommendations made by the Victorian Consultative Committee on Police Powers of Investigation. 304 The Act: lays down a principled and balanced regime for carrying out forensic procedures during the investigation of Commonwealth offences, and for the storage, use and destruction of material derived from these procedures. The [Act] carefully balances the rights of the suspect against the public interest in gathering evidence of serious offences. The rights and interests of the suspects are protected by providing numerous safeguards, and by requiring scrutiny of magistrates before the carrying out of most procedures where a suspect does not or cannot provide consent. Further safeguards have been built in to protect those under 18, persons who are incapable, and Aboriginal and Torres Strait Islanders, as those groups may be particularly vulnerable in the circumstances contemplated by the [Act] The key provisions relating to forensic procedures are contained in Schedule 1 of the Act, which is further divided into divisions. Definitions 5.4 The key definitions are contained in Division 1 of Schedule 1. For the purposes of Schedule 1 of the Act, forensic material includes bodily samples. A forensic procedure is defined as either an intimate forensic procedure or a non-intimate forensic procedure, but does not include any intrusion into a person s body cavities other than the mouth. 5.5 non-intimate forensic procedures include the following forensic procedures: the taking of a sample of hair other than pubic hair; the taking of a sample from a nail or under a nail; the taking of a sample by swab or washing from any external part of the body other than the genital or anal area, the buttocks or, in the case of a female, the breasts; the taking of a sample by vacuum suction, by scraping or by lifting tape from any external part of the body other than the genital or anal area, the buttocks or, in the case of a female, the breasts Note, it was not possible to obtain any information in English concerning forensic procedures in Sweden or The Netherlands. 303 For example, the Crimes Act 1958 (Vic). 304 Victorian Consultative Committee on Police Powers of Investigation, Report on body samples and examinations (Victorian Government, Melbourne, 1989). 305 Crimes Amendment (Forensic Procedures) Bill 1997, Explanatory Memorandum, p.1, cited in Australian Democrats, Genetic Privacy and Non-discrimination Bill 1998: Additional Comments (March 1999) para Crimes Amendment (Forensic Procedures) Act 1998, Division 1, s.23wa(1). 80

84 5.6 intimate forensic procedures include the following forensic procedures: the taking of a sample of blood; the taking of a sample of saliva, or a sample by buccal swab; the taking of a sample of pubic hair; the taking of a sample by swab or washing from the external genital or anal area, the buttocks or, in the case of a female, the breasts An indictable offence means an indictable offence against a law of the Commonwealth, but offence does not include an offence against a law of the Australian Capital Territory (ACT) or any other Territory. A relevant offence, in relation to a person who is a suspect, means: the indictable offence in relation to which the person is a suspect; any other indictable offence arising out of the same circumstances; or any other indictable offence in respect of which the evidence likely to be obtained as a result of a proposed forensic procedure carried out in the suspect is likely to have probative value. Forensic Procedures by Consent 5.8 Division 3 provides that a forensic procedure may be carried out with the informed consent of the suspect. 308 However, subsection 23WD(2) specifically provides that this Division does not authorise the carrying out of a forensic procedure on a child or an incapable person. This is reinforced in section 23WE of the Act which explicitly states that neither a child nor an incapable person can consent to a forensic procedure. 5.9 Section 23WJ details the information of which a suspect must be informed before consenting to a forensic procedure. This includes the way in which the forensic procedure is to be carried out, the purpose for which the forensic procedure is required, that the suspect may refuse to give consent, and the consequences of witholding consent. Consequences of Withholding Consent 5.10 The consequences of not consenting differ, depending on whether the forensic procedure is non-intimate or intimate and whether the suspect is in custody or not If the suspect is in custody and refuses to consent to a non-intimate procedure, a constable may order the procedure to be carried out under Division 4 of Schedule 1 of the Act, or make an application to a magistrate for an order authorising the carrying out of the forensic procedure. If the suspect is in custody and is refusing to consent to an intimate procedure, an application must be made to a magistrate for an order authorising the carrying out of the forensic procedure. Where the suspect is not in custody, an application must also be made to a magistrate for an authorisation order before the forensic procedure can be carried out Id. 308 Crimes Amendment (Forensic Procedures) Act 1998, Division 3, s.23wd(1). 309 Crimes Amendment (Forensic Procedures) Act 1998, Division 3, s.23wj(3), (4) and (5). 81

85 Ordering Non-intimate Forensic Procedures 5.12 If a suspect in custody refuses to consent to a non-intimate forensic procedure, Division 4 provides that a senior constable may order the procedure under s.23wn. This Division does not, however, apply where the suspect is a child or an incapable person. Before ordering a forensic procedure, the senior constable must be satisfied on the balance of probabilities that the suspect is in lawful custody, that there are reasonable grounds to believe the suspect committed the relevant offence, and that the forensic procedure is likely to produce evidence confirming or disproving this. The senior constable must also consider whether the order is justified in all the circumstances by balancing the public interest in obtaining forensic evidence against the public interest in upholding the physical integrity of the suspect. In balancing these interests, the senior constable should consider, inter alia: the gravity of the relevant offence and the circumstances in which it was committed; the degree of the suspect s alleged participation; the age, physical and mental health, cultural background and (where appropriate) religious beliefs of the suspect; whether there is a less intrusive way of obtaining the evidence; and the suspect s reason for refusing to give consent. 310 Forensic Procedures by Order of Magistrate 5.13 A magistrate may order the carrying out of a forensic procedure, under ss.23ws or 23XA, if the suspect is in custody (or not in custody) and has withheld consent to the procedure. Under s.23we, a magistrate may also order the carrying out of a forensic procedure on a person who is unable to consent. In determining whether or not to make the order, a magistrate must consider the same matters as a senior constable making an order under Division If a magistrate makes an order, the magistrate must inform the suspect that reasonable force may be used to ensure that s/he complies with the order for the carrying out of the forensic procedure. 312 Where the order sought is an interim order 313 (i.e. the procedure must be carried out without delay), whilst waiting for the order to be obtained, a constable may use reasonable force to prevent the suspect destroying or contaminating any evidence that might be obtained by the forensic procedure. 314 Carrying Out Forensic Procedures 5.15 Division 6 contains the rules governing the carrying out of forensic procedures which aim to safeguard the rights and interests of suspects. For example, s.23xi specifies that a forensic procedure must be carried out in circumstances affording reasonable privacy to the suspect. This includes not carrying out the procedure in the presence or view of a person of the opposite sex to the suspect, not removing more clothing than is necessary, nor involving more visual inspection than is necessary. It is also prohibited to continue questioning the suspect during the carrying out of the procedure Under s.23xj, the person carrying out the forensic procedure, or a constable, may use reasonable force to enable the procedure to be carried out or to prevent the destruction 310 Crimes Amendment (Forensic Procedures) Act 1998, Division 4, s.23wo. 311 Crimes Amendment (Forensic Procedures) Act 1998, Division 5, s.23wt. See above, paras 5.12 and following. 312 Crimes Amendment (Forensic Procedures) Act 1998, Division 5, s.23wy. 313 See Crimes Amendment (Forensic Procedures) Act 1998, Division 5, ss.23xa,b,c,d,e,f,g. 314 Crimes Amendment (Forensic Procedures) Act 1998, Division 5, s.23xf. 82

86 or contamination of any sample. However, this section does not authorise the carrying out of a forensic procedure in a cruel, inhuman or degrading manner. Section 23XL also states specifically that nothing in this part of the Act authorises the taking of a sample of hair by removing the root of the hair. Destruction of Forensic Material 5.17 The provisions in Division 8 relate to the destruction of forensic material taken from a suspect by a forensic procedure carried out under Schedule 1 (except s.23yq blood samples taken after conviction 315 ) Firstly, if an interim order authorising the carrying out of a forensic procedure is disallowed after the forensic procedure has been carried out, the investigating constable must ensure that all forensic material is destroyed and a copy of the results of any analysis are made available to the suspect. 316 Secondly, if the proceedings in respect of the relevant offence have not been instituted against the suspect, or have been discontinued after 12 months since the forensic material was taken, the forensic material must be destroyed as soon as practicable. 317 Thirdly, if the suspect is found to have committed a relevant offence but no conviction is recorded, or the suspect is acquitted of the offence and no appeal is launched, or an appeal is launched but the acquittal is confirmed or the appeal is withdrawn, the forensic material is again to be destroyed as soon as is practicable, unless an investigation or proceeding against the suspect for another relevant offence is pending. 318 However, subsection 23YD(4) provides that a constable or the Director of Public Prosecutions may apply to a magistrate for an extension of 12 months at a time, if the magistrate is satisfied that there are special (undefined) reasons for doing so. Storage and Disclosure of Information Obtained 5.19 Division 10 contains provisions relating to the storage and disclosure of information obtained under Schedule 1 of the Act Section 23YN prohibits information about a person obtained from forensic material taken under Schedule 1 from being recorded or retained in a personal records system after this Part requires the forensic material to be destroyed. A personal records system is a database of information that may be used to discover the identity of a person, or to get information about an identifiable person. However, under s.23yo, information obtained from a forensic analysis of material taken in accordance with Schedule 1 may be used for compiling a database for statistical purposes if the information cannot be used to identify the person on whom a forensic procedure was carried out For the purpose of the provisions relating to disclosure of information, offence means an offence against a law of the Commonwealth, a State or a Territory punishable by a maximum penalty of 12 or more months of imprisonment. 319 Section 23YP lists the circumstances in which a person may disclose information obtained through analysis of a forensic sample taken in accordance with the Act. Generally, these circumstances are restricted to purposes relevant to: the investigation, prosecution, or proceedings of an offence; the suspect s or a victim s medical treatment; and civil proceedings, including disciplinary proceedings, that relate to the way in which the procedure was carried out. Information may also be disclosed if it is either already publicly known or the suspect consents in writing to the disclosure. The penalty for intentionally or recklessly disclosing 315 See below, para Crimes Amendment (Forensic Procedures) Act 1998, Division 8, s.23yc. 317 Crimes Amendment (Forensic Procedures) Act 1998, Division 8, s.23yd(2). 318 Crimes Amendment (Forensic Procedures) Act 1998, Division 8, s,23yd(3). 319 Crimes Amendment (Forensic Procedures) Act 1998, Division 8, s.23yp. 83

87 information revealed by the carrying out of a forensic procedure, except as provided by this section, is 2 years imprisonment. Taking of Blood Samples After Conviction 5.22 Division 11 contains provisions which deal specifically with the taking of blood samples after a person has been convicted of a serious offence. For the purposes of this section, a serious offence means an offence punishable by a maximum penalty of 5 or more years of imprisonment Subsection 23YQ(2) specifies that if a court finds a person guilty of a serious offence, a constable may apply to the court for an order directing the person to give a sample of blood. Such an application can only be made after the expiration of any appeal period, or the determination of any appeal, whichever is later, and may only be made if, after that time, the conviction stands. If an order is made, and the person subject to the order refuses or fails to allow the blood sample to be taken, the person may be subject to a penalty of 12 months imprisonment. The provisions in Division apply to the taking of a blood sample under this section. Accordingly, reasonable force may be used to ensure the procedure is carried out. Children under 10 years old 5.24 Section 23YQA states that Schedule 1 does not authorise the carrying out of forensic procedures on a person who is under 10 years old. CANADA The DNA Identification Act 1998 and Bill S Both the DNA Identification Act and Bill S-10 relate to forensic DNA analysis for use in criminal prosecutions. However, as the primary purpose of this legislation is to authorise the establishment of a DNA data bank to be used to assist law enforcement agencies in the investigation of serious crimes, the Act and the Bill are both considered in full in the section, above, on DNA Data Banks. 321 Notwithstanding, the provisions should also be noted here. USA 5.26 The issues relating to forensic uses of DNA samples in the USA arise primarily in the context of criminal DNA databases (considered in detail in the section on DNA Data Banks 322 ) and will not be repeated here, although they should be noted A further issue relating to forensic use of DNA samples in the US is post conviction DNA testing. The US Department of Justice published a report entitled Post Conviction DNA Testing: Recommendations for Handling Requests, in September As the recommendations are highly specific to US legal procedures governing the admissibility of evidence, the report will not be considered here. However, it is available in full at: See above, paras 5.15 and See above, para 1.33 and 1.59 respectively. 322 See above, para 1.70 and following. 84

88 GERMANY 5.28 In Germany, the use of DNA testing for forensic investigations is regulated under the German Code of Criminal Procedure. Physical Examinations and Blood Tests 5.29 Section 81a(1) of the Code of Criminal Procedure states that a physical examination of the accused may be ordered to establish facts which are relevant to the proceedings. For this purpose, a physician acting in accordance with good medical practice (and with the necessary authority) may take blood samples and effect other bodily intrusions without the accused s consent, provided no detriment to his health is to be expected Under s.81a(2), the authority to make such an order is vested in the judge. However, if delay is likely to jeopardise the success of the examination, authority to order an examination extends to the public prosecution office including officials assisting it Section 81a(3) specifies that blood samples or other body cells taken from the accused may only be used for the purposes of the criminal proceedings for which they are taken, or in other pending criminal proceedings. Moreover, they must be destroyed without delay as soon as they are no longer required for those uses. Examination of Other Persons 5.32 Other persons who might be considered witnesses may be examined without their consent only insofar as: establishing the truth involves ascertaining whether their body shows a particular trace or consequence of a criminal offence; the examination is indispensable for establishing the truth, and no detriment to their health is to be expected; the examination or taking of a blood sample is carried out by a physician Section 81c(3) states that a person may refuse to undergo an examination or blood sample for the same reasons they may refuse testimony. 324 Subsection 81c(3) further provides for examinations of, or the taking of blood samples from, those who lack capacity to consent. It specifies that where minors lack intellectual capacity, or where minors or other persons placed in care due to mental illness or mental or emotional deficiency lack sufficient understanding of their right of refusal, the decision to consent to the examination or not shall be made by their statutory representative. However, if the statutory representative is prevented from making the decision in time, and securing evidence requires the examination or blood sample to be carried out immediately, a judge may make a special order authorising the examination. The decision ordering the examination or blood sample is not contestable. Evidence obtained pursuant to this section may only be used in further proceedings with the consent of the statutory representative. Subsection 81c(6) specifies that direct force may only be used to ensure the procedure is carried out upon special order of the judge. Molecular and Genetic Analysis 5.34 Section 81e provides that bodily substances obtained pursuant to subsections 81a(1) and 81c may be subjected to molecular and genetic analysis insofar as it is required 323 Code of Criminal Procedure, ss.81c(1) and (2). 324 Unfortunately, it was not possible to obtain the relevant sections of the Criminal Code that specify these reasons. 85

89 to establish descent or to ascertain whether traces found originate from the accused or the victim Under section 81f, molecular or genetic analysis may only be carried out upon a written order by the judge stating which expert is to carry out the analysis. The expert must be either publicly appointed, obliged under the Obligations Act, or hold public office, and must not be a member of the authority conducting the investigation. It is the responsibility of the expert to take the necessary measures to ensure that impermissible analyses are not carried out, and that unauthorised third parties cannot obtain access to the results of any such genetic analyses. Furthermore, the material to be analysed shall be given to the expert with no indication of the name, address, or day or month of birth of the individual from whom it derives. Where the expert is not a public agency, section 38 of the Federal Data Protection Act shall apply 325 with the condition that the supervisory authority shall also monitor compliance with data protection rules even if there is no indication that such rules are being violated, and the expert is not processing personal data in computer files. DNA Analysis 5.36 Under section 81g, cell tissue may be collected from a person accused of committing a criminal offence of substantial significance and subjected to molecular or genetic analysis for the purpose of establishing identity in future criminal proceedings if the nature of the offence or its commission, the accused s personality, or other information provide grounds for assuming that new criminal proceedings shall have to be instigated against the accused for one or more offences of substantial significance. Criminal offences of substantial significance include sexual offences, serious bodily injury, serious cases of theft, or blackmail. Any cell tissue collected for the purpose of molecular and genetic analysis pursuant to subsection 81g(1) shall be destroyed immediately once it is no longer required for that purpose. 326 SUMMARY 5.37 The provisions considered under this section relate very closely to the provisions considered in relation to criminal DNA databanks, and, ideally, the two should be considered in conjunction. The potential application of data protection and privacy legislation should also be noted There are considerable differences in the scope and terms of the forensic procedures legislation considered in this report. Firstly, the Australian Crimes Amendment (Forensic Procedures) Act 1998 is the only legislation that distinguishes between intimate and non-intimate forensic procedures. The significance of this distinction in terms of the Act relates primarily to the ordering of forensic procedures to which the suspect has not consented. Non-intimate procedures may be carried out without the suspect s consent on the order of a constable; whereas an order from a magistrate authorising the carrying out of the procedure must be obtained before an intimate procedure can be carried out on a suspect who has not consented. The Act specifically provides, however, that a court order must be obtained to authorise the carrying out of any forensic procedure on a minor or person who lacks the capacity to consent. 325 See above, para Code of Criminal Procedure, s.81g(2). 327 Eg the application of the German Federal Data Protection Act to genetic analysis authorised under the Criminal Code. See above, para

90 5.39 Other differences are to be found in terms of the types of procedures that may be authorised. For example, the Canadian Criminal Code 328 authorises the taking of buccal swabs, blood samples, and hairs, including the root sheath, whereas the Australian legislation specifically provides that the Act does not authorise the taking of a hair by removing the root. Moreover, the German Code of Criminal Procedure authorises the taking of blood and other bodily intrusions The various legislation also contains different provisions regarding the use of force to enable a procedure to be carried out. At one extreme, the Canadian legislation provides that as much force as is necessary may be used for the purpose of carrying out the procedure. In contrast, the German legislation states that the use of direct force must be authorised by a special court order All the legislation contains provisions which apply to forensic procedures carried out on minors and/or persons incapable of giving their consent. The Canadian Criminal Code stipulates that where the procedure is to be carried out on a young person, in accordance with the Young Offenders Act, that person has the right to a reasonable opportunity to consult with, and have the warrant executed in the presence of, counsel, a parent, and/or another appropriate adult. However, a young person may waive this right, provided such waiver is recorded on audio or videotape, or it is in writing, containing a statement that the young person has been informed of the right being waived The provisions in the Canadian Code are somewhat out of line with those in both Australia and Germany. The Australian Act explicitly provides that court authorisation must be sought before a forensic procedure may be carried out on a minor, or person incapable of giving consent; and the German Code stipulates that consent must be sought from either the minor s, or incapable person s, statutory representative or the court Australia and Germany stipulate that samples obtained in accordance with the legislation may only be used for the purposes of the investigation or prosecution of an offence, 329 and must be destroyed without delay once they are no longer required for these purposes. Although the Canadian DNA Identification Act is not yet in force, it will permit samples to be collected and stored from convicted offenders, for the purpose of assisting law enforcement agencies in the prevention and detection of serious crime. 328 See Canadian DNA Identification Act 1998, considered above, para 1.33 and following. 329 Note, however, that the Australian Act provides that information obtained from forensic analyses may be used for compiling a database for statistical purposes, provided the information is de-identified. 87

91 RESEARCH 330 AUSTRALIA Current Regulation 6.1 Medical research in Australia is self-regulated. The National Health and Medical Research Council Act 1992 established the National Health and Medical Research Council (NHMRC), the principle regulatory mechanism, and its subsidiary bodies, the Australian Health Ethics Committee (AHEC) and the Institutional Ethical Committees (IECs). The AHEC is responsible for developing NHMRC guidelines for ethical conduct in research involving humans. All Australian research proposals must be approved by IECs before they can be undertaken. National Health and Medical Research Council: National Statement on Ethical Conduct in Research Involving Humans 6.2 The Australian National Health and Medical Research Council (NHMRC) has developed general guidelines on research involving humans in its National Statement on Ethical Conduct in Research Involving Humans (1999). Section 16 of the National Statement focuses on ethical considerations that arise specifically in human genetic research. Privacy and Confidentiality 6.3 The overriding principle is that researchers must ensure the confidentiality and privacy of any stored genetic information or research results relating to identified or potentially identifiable participants. 331 Researchers must also ensure the confidentiality of any information provided by participants about members of their family. 6.4 The research protocol must specify whether genetic information or genetic material, and any information derived from it, is to be stored in identifiable, coded, or de-identified form. Moreover, researchers should be aware that some genetic disorders are so rare that it may be possible for other researchers, or even members of the community, to identify the participant, even if any information about them is communicated in de-identified form The National Statement also contains guidelines on the disclosure of information to other researchers, members of the participant s family, and other third parties. With regard to other researchers, genetic material and any information derived from it must not be transferred to other research groups unless they are collaborating on research which has been approved by a Human Research Ethics Committee (HREC) and the information is provided in de-identified form. However, an HREC may approve transfer of genetic information in an identifiable or coded form, in which case the other research group must ensure there is no reduction in the protection of the privacy of participants and the confidentiality of the information. 333 A researcher must not disclose identifying genetic information to third parties, including family members, without the written consent of the individual to whom the information relates, or the written consent of a person or institution which may legally consent on the participant s behalf Note, it was not possible to obtain any information in English concerning human genetics research in The Netherlands. 331 NHMRC, National Statement on Ethical Conduct in Research Involving Humans (1999), paragraph 16.3 (hereinafter National Statement). 332 National Statement, paragraph National Statement, paragraph National Statement, paragraph

92 Consent 6.6 As a general principle, a researcher must always obtain consent from participants when proposing to conduct human genetic research. However, the National Statement provides that an HREC may sometimes waive, with or without conditions, the requirement for consent. In determining whether it is appropriate to waive consent, and HREC should consider, inter alia: the nature and extent of any existing consent relating to the collection and storage of the genetic material and genetic information; the researchers justification for seeking to have consent waived, including whether obtaining specific consent would be impracticable or intrusive; the proposed privacy protections, including the possibility of de-identifying the genetic material and information; the possibility of commercially exploiting derivatives of the sample; and relevant statutory provisions If, as in most cases, consent is required, the National Statement sets out the information that should be provided to prospective participants when their consent is being sought. Firstly, a prospective participant must be informed that they are free to refuse consent without giving reasons. Other information to be provided includes information about how the privacy and confidentiality of their genetic information will be protected, including whether the information is to be used in an identified, coded, or de-identified form. Prospective participants should also be informed if the research might reveal information of potential importance to their own future health, or that of their offspring or other family members, and whether the research may detect non-paternity or non-maternity; and that if the research does generate this kind of information, that the consent of the participant will be sought before disclosing such information to the family members concerned. Furthermore, participants should be informed that their genetic material and genetic information will not be released for uses unrelated to HREC research without their consent, unless required by law. They should also be informed of any intention to store their genetic material or genetic information for future unspecified research, and that consent for future research use may be refused, in which case the genetic material and information will be disposed of at the end of the initial research. Finally, prospective participants should be informed that they are free to withdraw from the research at any time If an organisation or institution wants to conduct research on genetic material or information that was collected for another purpose (i.e. non-research purposes), the organisation should develop and disseminate a general policy informing patients that such samples and information may be used for future research following HREC approval. However, patients should be informed that they can refuse to consent to the use of their genetic material or information in such research. Genetic Counselling 6.9 The National Statement provides that if research is likely to reveal information about the future health of an identified or identifiable participant, or the participant s offspring, the research protocol must provide counselling, support, test quality and test result confidentiality 335 National Statement, paragraph National Statement, paragraph

93 procedures that would apply in a clinical setting. Accordingly, genetic counselling must be provided by health professionals with appropriate training, skills and experience Counselling should also be provided when individuals are asked to consent to the use of their genetic material or genetic information in future research. 338 National Health and Medical Research Council: Ethical Aspects of Human Genetic Testing: an Information Paper 6.11 As well as the section on human genetic research contained in the National Statement on Ethical Conduct in Research Involving Humans, the National Health and Medical Research Council (NHMRC) has also issued an Information Paper 339 on ethical aspects of human genetic testing, to be read in conjunction with the National Statement. The Information Paper is a very comprehensive document comprising some 80 pages and covering all aspects of genetic testing and the ethical considerations that arise. However, the Information Paper approaches these issues in terms of genetic testing in general as opposed to genetic testing for specific purposes such as research. Occasional mentions are made of specific purposes, but, because of the focus on general ethical issues, the Information Paper does not provide additional guidance, but rather flag-posts particular concerns. For example, Chapter 2 covers genetic testing and the storage of genetic information. In terms of testing as part of research, the Information Paper refers the reader to the NHMRC National Statement on Ethical Conduct in Research Involving Humans, and illustrates that in some research settings participants should be treated as they would in a clinical setting, 340 whereas in others, there will be considerable differences. 341 Similarly, in discussing the ethical issues relating to the storage of genetic information obtained from a test performed in a research setting, the Information Paper only specifies that the test result should be stored in accordance with good practice and then disposed of Given that the Information Paper does not expand on the guidelines contained in the National Statement, it will not be considered further. The Genetic Privacy and Non-discrimination Bill In drafting the terms of the Genetic Privacy and Non-discrimination Bill, the Australian Democrats attempted to balance the possible legal requirement for specific consent and confidentiality against the public interest in conducting research and the possible difficulties obtaining specific consent in every circumstance. 343 The Australian Democrats considered that, on balance, specific consent should be required because: it would be unethical to diagnose a person anonymously because they might not be alerted to obtain treatment (subject to their right not to know) or be able to warn others (e.g. of an infectious disease); the better view is that specific consent is required by law; and the disclosure of confidential information for research without consent does not fall into an established exception because it is does not maintain the doctor patient relationship, is not required by law, and does not support the public interest in that 337 National Statement, paragraph National Statement, paragraph NHMRC, Ethical Aspects of Human Genetic Testing: an Information Paper (2000) (hereinafter Information Paper). 340 For example, research that addresses disorders caused by rare high-risk mutant genes and is designed in a way which may reveal genetic information of significance to the future health of participants and their families. Information Paper, p For example, genetic research that addresses disorders associated with susceptibility genes, i.e. common low-risk mutant genes. Information Paper, p Information Paper, p Australian Democrats, Genetic Privacy and Non-discrimination Bill 1998: Additional Comments (March 1999), p

94 medical research is not a public responsibility in the way that enforcement of the law is Accordingly, Part 5 of the Genetic Privacy and Non-discrimination Bill contains detailed provisions regulating research involving genetic analysis and the disclosure of genetic information for research purposes. Research Involving Genetic Analysis 6.15 Clause 20 sets out the conditions which must be met for a DNA sample to be analysed as part of a research project. Firstly, the use of DNA samples must be essential to the research project, and the potential benefit of the research project to society must outweigh the potential risks to the participants. Secondly, the research protocol must: contain adequate safeguards to protect the confidentiality of genetic information derived from the research; meet the requirements of clause 12 (collection of samples), including providing the individual with a notice of rights and assurances and obtaining written consent from the individual concerned; 345 describe the intended uses of the DNA samples; describe the availability, or not, of genetic counselling; and in relation to research protocols involving the use of DNA samples from deceased subjects, provide reasonable methods for disclosing to the subject s family members the risks associated with the genetic information to be generated by the research, and take into account the right of family members to refuse to be informed about the genetic information Subsection 20(2) specifies the minimum safeguards required to adequately protect the confidentiality of genetic information for the purposes of subsection 20(1). These include satisfying any guidelines issued by the National Health and Medical Research Council, ensuring participants will not be identifiable in any publication resulting from the research without their authorisation, and having procedures to remove individual identifiers as soon as is practicable Under clause 20(4), any DNA sample stored in connection with the research project must be destroyed upon the project s completion, or upon the withdrawal of the participant, whichever occurs first, unless the researcher has obtained express authorisation from the participant that the sample may be stored after that date (in accordance with the provisions of the Bill 347 ) If a research project proposes to include genetic analysis of a participant s family members, for pedigree or linkage analysis, the process of obtaining consent must also include information about the possibility that the research will reveal non-paternity or nonmaternity C Thompson, Records, research and access: what interests should outweigh privacy and confidentiality? Some Australian answers (1993) 1 Jnl of Law and Med 95, p.99, cited in Australian Democrats, Genetic Privacy and Non-discrimination Bill 1998: Additional Comments (March 1999), p See above, paras 1.26, Genetic Privacy and Non-discrimination Bill 1998, cl.20(1). 347 See above, para 1.24 and following 348 Genetic Privacy and Non-discrimination Bill 1998, cl.20(4). 91

95 Disclosure of Genetic Information for Research Purposes 6.19 Under clause 21, a person storing genetic information may only disclose that information to third parties according to the written authorisation of the subject. However, subsection 21(2) provides that notwithstanding subsection (1), a person storing genetic information may grant access to such information if the purposes is to compile data for statistical or epidemiological studies, and identifiable genetic information is not copied, removed or re-disclosed in any way. The person seeking access to the information must also certify in writing that subsection 20(2) will be complied with, that the person has complied with this Bill, and that the person is aware of liability for breaches of this Bill. DNA Samples Collected Prior to the Commencement Date 6.20 Clause 22 provides that a person has 3 years from commencement of the Bill to submit a written request that a sample collected from them prior to the commencement date be withdrawn or destroyed. After this period, such samples may be analysed as part of a research project if the subject has not objected in writing. Furthermore, the clause specifies that such information may only be disclosed with the authorisation of the subject or their legal representative, except as otherwise provided by the Bill. Ownership 6.21 It is worth noting that under the provisions of clause 16, which relate to the individual s written authorisation for others to collect, store and analyse DNA samples, 349 any authorisation must include provisions that permit the individual to consent to: use of the DNA sample for research; and commercial use of the DNA sample, with a waiver of, or a provision for, economic benefit to the individual In other words, the Bill proposes that a research subject should have a financial interest in the outcome of the use of a DNA sample. The aim of this provision is to legislate a solution to the issue of ownership of personal genetic information, which raised concern in the US case of Moore v Regents of the University of California 350, in which scientists derived profits from tissue research without telling the donor of the tissue. The Senate Legal and Constitutional Legislation Committee 6.23 As regards privacy issues in relation to research, the Committee concluded that in general medical research is well regulated in Australia, although it is not clear to what extent private sector funded research is covered by the NHMRC guidelines However, the Committee expressed concern that the issue of ownership of genetic material and, in particular, information derived from such material, as raised by the Bill, requires further consideration The Committee heard various submissions arguing against an individual having a property right in a sample, or information derived from analysis of the sample. For example, SmithKline Beecham International submitted that: 349 See above, para For details see eg The Committee, chp.4, p.7. 92

96 If the analysis and manipulation of the DNA sample finally results in the production of some beneficial therapeutic outcome for the benefit of mankind as a whole, it is questionable whether an individual should have this potential economic interest The Committee also noted the fact that it has been argued that there is a need for legislation to recognise group property interests and group property rights in the disclosure of results of DNA analysis, on the basis that: the Human Genome Project aims to map the genetic structure of small racial subgroups in the belief that there may be valuable properties to be found in the genome of small divergent groups which are not represented in larger populations. 353 CANADA Research Councils of Canada: Ethical Conduct for Research Involving Humans 6.27 In 1998, the three Canadian research councils issued a statement on the conduct of any sort of research involving humans. 354 Research Involving Biological Samples 6.28 Article 1.1(b) states that all research involving human remains, cadavers, tissues, biological fluids, embryos or foetuses requires review and approval by a Research Ethics Board (REB), in accordance with the Policy Statement, before the research is started The Policy Statement stipulates that in the case of biomedical research, at least one member of the REB must have knowledge of the relevant law. 355 Before approval can be given, the REB must be satisfied that the proposed research project is capable of addressing the questions being asked in the research, and does not pose more than a minimal risk to subjects. 356 The general principle is that the more invasive the research, the greater should be the care in assessing the research. Consent 6.30 As regards consent, the Policy Statement stipulates that research approved in accordance with the Statement may only proceed if the prospective subjects, or authorised third parties, have given their free and informed consent (usually to be obtained in writing). 357 Moreover, their free and informed consent must be retained throughout the duration of the research project. However, the REB has discretion to waive the requirement of informed consent, or alter some of its elements, provided that: the research involves no more than minimal risks to the subjects; the waiver or alteration is unlikely to affect the rights and welfare of the subjects; the research could not practicably be carried out without the waiver or alteration; 352 SmithKline Beecham International, cited in The Committee, chp.4, p The Plunkett Centre for Ethics in Health Care, cited in The Committee, chp.4, p The Tri-Council Policy Statement can be viewed in full at: Research Councils of Canada, Policy Statement on Ethical Conduct for Research Involving Humans, article 1.39(c) (hereinafter Policy Statement). 356 Policy Statement, article 1.5(a). 357 Policy Statement, article 2.1(a). 93

97 wherever possible and appropriate, the subjects will be provided with additional pertinent information after participation; and the waivered or altered consent does not involve a therapeutic intervention In order to meet the requirement of informed consent, researchers must provide prospective participants with all the information relevant to free and informed consent. This information includes a comprehensible statement of the research purpose, the identity of the researcher, the expected duration and nature of participation, and a description of the research procedures. 359 Furthermore, the prospective participant should be informed of any reasonably foreseeable harms and benefits that may arise from participation in the research project. Prospective participants must also be informed that they are entitled to refuse to participate, or, if they decide to participate, that they may withdraw at any time. Finally, they should also be informed about the possibility that research findings will be commercialised As regards individuals who are not legally competent to consent, subject to applicable legal requirements, such individuals should only be asked to become research subjects when: the research question can only be addressed by using the identified group(s); free and informed consent will be obtained from a third party legally authorised to consent on their behalf; and the research does not expose them to more than minimal risks without the potential for direct benefit to them. 361 Identifiable Personal Information 6.33 The Policy Statement specifies that researchers must secure the approval of the REB before obtaining identifiable personal information about the subjects. In determining whether to approve the use of identifiable data, the REB must consider factors such as the type of data, the purpose(s) for which data will be used, limits on the use, disclosure, and retention of the data, appropriate safeguards for security and confidentiality, any anticipated secondary uses of identifiable data from the research, and any anticipated linkage of data Furthermore, the researchers must satisfy the REB that identifying information is essential to the research, and that appropriate measures will be taken to protect the privacy and confidentiality of data subjects. Genetic Research 6.35 As well as the general provisions which apply to all research involving humans, the policy statement also contains a number of provisions which apply specifically to genetic research Firstly, a genetic researcher must obtain free and informed consent from prospective participants. 363 Furthermore, the researcher and the REB must ensure that genetic information about an individual is protected from access by third parties, unless the individual to whom the data relates gives free and informed consent to disclosure. 364 The research should also involve genetic counsellors who can provide the REB with information about any potential harm to participants and their families, and how such risks will be addressed. 358 Policy Statement, article 2.1(c). 359 Policy Statement, article 2.4(b). 360 Policy Statement, articles 2.4(c), (d) and (e). 361 Policy Statement, article Policy Statement, article Policy Statement, article Policy Statement, article

98 Where appropriate, genetic counselling should also be provided for the research subjects. 365 If the research is to involve DNA banking, the researchers are under a duty to satisfy the REB that the ethical issues involved have been adequately addressed, including confidentiality, privacy, storage, use of the data and results, withdrawal by the subject, and future contact with the subjects and their families. 366 Researchers must also discuss with the REB and the research subject the possibility and/or probability that the genetic material and the information derived from it may have potential commercial uses. Research Involving the Collection and Use of Human Tissue 6.37 Articles 10.1 to 10.3 contain further provisions relating to research proposing the collection and use of human tissues. Firstly, such research requires ethics review by an REB. The researchers must demonstrate that the research will be undertaken with the free and informed consent of competent donors, or, in the case of incompetent donors, the consent of an authorised third party. Where the donor is deceased, consent should be expressed in a prior directive, or by an authorised third party For the purposes of obtaining free and informed consent, researchers must provide potential donors with information as to the purpose of the research, the type and amount of tissue to be taken, the manner in which the tissue will be taken, the potential uses of the tissue sample including commercial uses, identifying information to be attached to the sample, and safeguards in place to protect the donor s privacy and confidentiality Where it is possible to identify a donor, researchers must seek their consent for further use of the previously collected tissue. However, where donors are not individually identifiable, and when there is no potential harm to them, it is not necessary to seek their consent to use their tissue sample for further research. Natural Sciences and Engineering Research Council of Canada: Human Genetic Research 6.40 As well as contributing to the Tri-Council statement, the Natural Sciences and Engineering Research Council of Canada (NSERC) has issued guidelines which deal specifically with human genetic research Article 8.1 of the guidelines provides that researchers must seek free and informed consent from the individual and report results to that individual if the individual so desires. The guidelines also advise that researchers should be aware that, in certain circumstances, members within a family may be coerced by other members to join the study Article 8.2 stipulates that the researcher and the Research Ethics Board (REB) must ensure that the results of genetic testing which form part of the research must be protected from access by third parties, unless the relevant individual has given informed consent to such access. Moreover, family information held in databanks must be coded so as to remove the possibility of identification of subjects within the bank itself The guidelines further provide that researchers and genetic counsellors must reveal any potential harms to participants to the REB, and outline how the research project will address the risk of such harms. 367 The NSERC also stipulates that, where appropriate, genetic counselling should be made available to participants. 365 Policy Statement, articles 8.3 and Policy Statement, article NSERC, Human Genetic Research, Article

99 6.44 In addition, the guidelines provide that the researcher should discuss at the outset of a research project the possibility and/or probability that the genetic material and information derived from its use may have potential commercial uses. This issue should be discussed with both the REB and the research subjects. USA Code of Federal Regulations: Protection of Human Subjects 6.45 The Federal Policy for the Protection of Human Subjects 368 applies to all research involving human subjects conducted, supported or otherwise subject to regulation by any Federal Department or Agency which takes appropriate administrative action to make the policy applicable to such research. 369 Under s (b), unless otherwise required by Department or Agency heads, research which only involves human subjects to the extent that the research involves the collection or studying of existing data, documents, records, pathological specimens or diagnostic specimens is exempt from the federal regulations, if these sources are either publicly available or if the information is de-identified by the investigator. Accordingly, research into existing samples stored, for example, in a DNA repository, will not be subject to the regulations, provided the information is recorded by the investigator in such a manner that the subjects cannot be identified either directly or through identifiers linked to the subjects In other research involving human subjects, the key means by which the regulations seek to protect the rights and interests of individuals participating in the project are the concepts of minimal risk and informed consent. 370 However, the effectiveness of these concepts at safeguarding subjects participating in human genetics research has been doubted. 371 Minimal Risk 6.47 The concept of minimal risk is central to both the consent requirements (considered below) and the review to which the research protocol will be subject. Despite the significance of the concept, there is substantial disagreement about what constitutes minimal risk, and the concept is applied quite variously. 372 Minimal risk is defined in the regulations as a risk for which the probability and magnitude of harm or discomfort anticipated are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests. 373 However, a recent National Bioethics Advisory Commission (NBAC) report concludes that the debate about the meaning of minimal risk will surely persist because of the philosophical and practical difficulties of defining it precisely With regard to the role of the concept of minimal risk in terms of the review to which the research protocol will be subject, the key concern is that in 1998 the Office for Protection from Research Risks (OPRR) revised the federal regulations to increase the categories of research eligible for expedited review (that is, review by as few as one member of an IRB) to 368 Code of Federal Regulations, Title 45 Part 46, Subpart A (effective 19 August 1991) (hereinafter Regulations). 369 Regulations, s B. Woodward, Challenges to Human Research Subject Protections in US Medical Research (1999) 282:20 JAMA 1947, p See below, paras B. Woodward, Challenges to Human Research Subject Protections in US Medical Research (1999) 282:20 JAMA 1947, p Regulations, s (h)(i). 374 NBAC, Research Involving Persons With Mental Disorders That May Affect Decision Making Capacity (1998), cited in B. Woodward, Challenges to Human Research Subject Protections in US Medical Research (1999) 282:20 JAMA 1947, p

100 include research involving the use of human tissue and medical records. The IRBs are the institutional research bodies tasked with reviewing and approving research protocols and monitoring the research project. 375 A pre-condition for expedited review is that the research represents a minimal risk for the subject. However, letters written by researchers and ethicists in response to the revisions proposed in 1997 revealed a lack of agreement as to the status of genetics research involving the use of human tissue and medical records. 376 Although the final list of categories of research eligible for expedited review noted that confidentiality concerns and the risk of stigmatisation must be taken into account in determining minimal risk status (a pre-condition of eligibility for expedited review), several commentators have argued that the determination of minimal risk in genetic studies and medical records research is sufficiently problematic that review by a full IRB ought to be required for these kinds of research. 377 Informed Consent 6.49 The basic elements of informed consent are set out in section of the regulations. It provides that, in seeking informed consent, the following information must be provided to each subject: an explanation of the purpose of the research and the expected duration of the participant s participation, a description of the procedures to be followed, and identification of any procedures which are experimental; a description of any reasonably foreseeable risks or discomforts to the subject; a description of any potential benefits to the subjects or to others; a disclosure of appropriate alternative procedures; a statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained; for research involving more than minimal risk, an explanation as to whether any compensation or medical treatments are available if injury occurs; an explanation of whom the subject should contact regarding queries related to the research; a statement that participation is voluntary, and that refusal to participate, or withdrawal from the research at any time, will involve no penalty or loss of benefits to which the subject is otherwise entitled The regulations provide that, in certain cases, the consent requirements may be altered or waived. The most significant and contentious 378 exception with regard to genetics research applies where the institutional review board is satisfied that: the research involves no more than minimal risk to the subjects; the waiver or alteration will not adversely affect the rights and welfare of the subjects; the research could not practicably be carried out without the waiver or alteration; and whenever appropriate, the subjects will be provided with additional pertinent information after participation Regulations, ss to B. Woodward, Challenges to Human Research Subject Protections in US Medical Research (1999) 282:20 JAMA 1947, p Id. 378 See id. 97

101 6.51 The IRB system is intended to ensure that individual research protocols are reviewed and approved in accordance with the regulations. Thus, it is for the IRBs to satisfy themselves that the requirements for waiving informed consent have been complied with in the relevant research protocol. Two problems arise in this respect. Firstly, informed consent may only be waived if the research poses minimal risk to the subject. As noted above, there is no uniform understanding of minimal risk, particularly with regard to research involving human tissue samples or medical records. Moreover, the second criteria for waiving the need for informed consent (the rights and welfare requirement) also suffers from practical difficulties of interpretation. 380 Secondly, in recent years, the capabilities of the IRBs have been questioned by the Department of Health and Human Services Office of the Inspector General, the US General Accounting Office, and the Committee on Human Radiation Experiments. 381 According to the 1996 US General Accounting Office report, in some cases the sheer number of studies necessitates that IRBs spend only one or two minutes of review per study. 382 Given the sensitivities of research into human genetics and the use of DNA samples, this is particularly worrying Moreover, in just over a year, the OPRR restricted or suspended research activities at eight institutions. 383 At several of these institutions, the OPRR found that IRBs had granted waivers of consent without finding and documenting the presence of the four criteria required by the regulations 384 in accordance with section The National Bioethics Advisory Committee: Research Involving Human Biological Materials: Ethical Issues and Policy Guidance 6.53 The National Bioethics Advisory Committee (NBAC) published its report on research involving human biological materials 385 in Perhaps surprisingly, the report proposes a weakening of the consent requirement. Recommendation 12 advocates that the present federal regulations be changed so that IRBs can grant waivers of the consent requirement for studies involving identifiable, existing human biological materials, even where it is practicable to obtain consent. 386 The NBAC considers that even in instances when it might be considered practicable to obtain consent for research use of stored biological materials, it may be burdensome for investigators to do so This departure is to be considered surprising in light of the fact that, in 1997, the NBAC resolved, as a matter of ethical principle, that no person should be enrolled in research without the twin protections of informed consent and independent review of the research. 388 Perhaps even more worrying, however, is the inconsistent approach adopted by the NBAC to the risk status of research involving stored human tissue samples. For example, at page 55, the NBAC states with respect to genetics research that: potential harms to individuals who are the subjects of such research are poorly understood and hence could be over- or under-estimated. This is particularly true of non-physical harms, which can occur in research conducted using previously 379 Regulations, s (d). 380 See NBAC, Research Involving Human Biological Materials: Ethical Issues and Policy Guidance (1999), p See B. Woodward, Challenges to Human Research Subject Protections in US Medical Research (1999) 282:20 JAMA 1947, p Cited in, id. 383 Id. 384 Id., p NBAC, Research Involving Human Biological Materials: Ethical Issues and Policy Guidance (1999) (available in full at Emphasis added. 387 NBAC, Research Involving Human Biological Materials: Ethical Issues and Policy Guidance (1999), p NBAC, Summary of Preliminary Findings: Adequacy of Federal Protections for Human Subjects in Research (1999) (available at cited in B. Woodward, Challenges to Human Research Subject Protections in US Medical Research (1999) 282:20 JAMA 1947, p

102 collected human biological materials when investigators do not interact directly with the persons whose tissues, cells, or DNA they are studying Indeed, just a few pages previously, the report states that: In NBAC s judgement, where the research uses identified or coded samples from previously collected specimens, such uses are usually not justified without the source s consent, because the risk to sources and others may be more than minimal Notwithstanding these concerns, the NBAC states in recommendation 10 that studies that do not involve inappropriate release of information to the subject or third parties may be considered minimal risk Given the concerns and conflicting opinions expressed by the NBAC regarding the risk status of research with existing human biological materials, it might have been more appropriate to recommend that such research, whether minimal risk or not, should generally be carried out on de-identified materials if it is burdensome to obtain consent. 391 GERMANY Existing Regulation 6.58 There is currently no specific regulation in Germany on the use of genetic data in research. However, it is likely that this issue will be addressed by the recently established German Bundestag Commission of Inquiry into Law and Ethics in Modern Medicine. The German Society of Human Genetics: Position Paper 6.59 The German Society of Human Genetics (GfH) addresses some of the ethical issues relevant to research in human genetics in its Position Paper of The GfH begin by acknowledging that the specific history of human genetics in Germany demonstrates that there can be a real danger of the loss of respect for the dignity of individuals. 393 Accordingly, the GfH takes this as the fundamental and overriding principle: respect for the dignity of the individual person. From this principle others are derived, including the principles of self-determination, basic human equality, confidentiality and education The GfH states that these principles should be applied in research both when the project is planned and when it is carried out. Moreover, the consequences of possible research results and their practical application must be considered, bearing in mind the potential for discrimination and stigmatisation. 395 The nature of genetic information requires a strict standard of confidentiality, and genetic data should only be released with the written consent of the individual in response to an express request, and then only if the individual is fully informed of the consequences of releasing the data NBAC, Research Involving Human Biological Materials: Ethical Issues and Policy Guidance (1999), p Id., p B. Woodward, Challenges to Human Research Subject Protections in US Medical Research (1999) 282:20 JAMA 1947, p Deutsche Gesellschaft fur Humangenetik e.v., Position Paper of the German Society of Human Genetics (1996). 393 Position Paper of the German Society of Human Genetics (1996), p.a Id., p.a Id. 396 See Data Protection and Privacy above, para &

103 6.62 The GfH considers that an individual s right to be fully informed extends to the results of research projects in which s/he has been involved. After genetic studies have been carried out, the individual has the right to obtain complete information about all the results that could be relevant to his/her own health and that of his/her children. However, an individual s right not to know must also be respected if they do not want to know the results of the study If an individual does wish to be informed of the results of the study that relate to his/her own health or that of his/her children, the individual should be told by a medical geneticist during a genetic counselling session. 398 SWEDEN Existing Regulation 6.64 In Sweden, the Act concerning Use of Gene Technology on Human Beings came into force in October The Act is based on the Government Bill (1990:52) and deals with the study of human genetic codes by analysing DNA or RNA where this constitutes or forms part of a screening programme. The Act Concerning Use of Gene Technology on Human Beings Under the terms of the Act, where genetic examinations using DNA or RNA analysis constitute part of a health-screening programme, special permission is required from the National Board of Health and Welfare. 400 Special permission is required because, although participation in screening is voluntary and requires consent, the fact that an individual is summoned to the examination as opposed to initiating it himself (as in the case of individual genetic examinations), makes a difference from an ethical viewpoint. Accordingly, the Ministry of Health and Social Affairs considered it essential that restrictions should be imposed by legislation. 401 Requiring the approval of the National Board of Health and Welfare is, therefore, intended to ensure that genetic testing in the context of health screening: will only be used on ethically acceptable terms, will be performed with the necessary competence and sense of responsibility, and that the risks of abuse will be minimised Section 2 of the Act stipulates that permission may only be granted if the study has a clear, medically justified aim. Accordingly, the study should concern pathological conditions for which a cure, treatment or relief can be offered. Furthermore, it should particularly be considered whether there are satisfactory privacy safeguards to protect the genetic data obtained Section 5 of the Act further provides that participants must give written consent in order for the genetic examination to be performed. The Act stipulates that before a valid 397 Position Paper of the German Society of Human Genetics (1996), p.a Id. 399 Ministry of Health and Social Affairs, Swedish Act Concerning Use of Gene Technology on Human Beings 1991 (English Summary). 400 Act Concerning the Use of Gene Technology on Human Beings 1991, s Ministry of Health and Social Affairs, Swedish Act Concerning Use of Gene Technology on Human Beings 1991 (English Summary), p Id. 100

104 consent can be given, the individual concerned must be fully informed of the implications and possible consequences of participating in the study Any genetic data obtained in the study is subject to existing legislative protections. 404 Swedish Medical Research Council: Research Ethics Guidelines for Using Biobanks 6.69 Following an increasing number of inquiries from both research ethics committees and the pharmaceutical industry regarding the conditions for continued use of human biological material collected in biobanks, the Swedish Medical Research Council (MFR) issued guidelines on research ethics for using biobanks in At present, Swedish legislation only offers protection for information derived from tissue samples, 406 not for the actual samples themselves. Accordingly, the MFR considered that there were many ethical issues which needed to be addressed, including ownership rights, and issues related to responsibility. 407 Indeed, in March 1999, the MFR requested that the Ministry of Education and the Ministry of Health and Social Affairs appoint a commission to review the both the legal aspects of these issues and the application of existing legislation The guidelines are intended to advise both individual researchers and the pharmaceutical industry, as well as national research ethics committees. 408 They apply to the use of biobanks for research, regardless of whether the samples were originally collected as part of routine medical care or for previous or current research purposes. Where appropriate, the guidelines also apply when biological material is collected for an identified research project. 409 Storage, Organisation and Responsibility 6.72 The guidelines stipulate that all biobanks containing biological material and associated information about individuals must have in place explicit procedures for quality assurance, including systems for storage, identification and preservation of anonymity (coding), and registration. They must also have clear policies regarding responsibility and management The MFR s Committee for Research Ethics considers that if biobanks are to be of use in future biomedical research, the identity of the samples must be preserved. However, the MFR states that it is essential that biological material is coded and that the code key is stored separately. Furthermore, the code must be kept within public-sector organisations, and biobanks must operate strict rules governing the storage and use of the code key. Conditions for Use 6.74 The guidelines set out the conditions that must be met if researchers are to obtain and use stored biological samples. Essentially, an application must be approved by a research ethics committee before the research project can proceed. The application must state clearly whether genome analyses will be conducted and/or whether a biobank will be 403 Id. 404 See above, para Swedish Medical research Council, Research ethics guidelines for using biobanks, especially projects involving genome research (June 1999) (hereinafter Research Ethics Guidelines). 406 See above, para Research Ethics Guidelines, p Research Ethics Guidelines, p Id. 101

105 built up. 410 The research ethics committee must give particular consideration to the issue of informed consent having regard to the specific circumstances of the proposed research project. Informed Consent for Storage 6.75 The guidelines provide that anyone intending to collect and store biological material and associated information must first obtain the individual s informed consent. To comply with the guidelines, individuals must be informed about storage procedures, including the length of storage. It must also be made clear that the material may be used for future research (although such research will require approval by the research ethics committee), and that donors may be contacted again. Individuals must also be informed that they are entitled to request that their samples be destroyed at any time. Informed Consent for New Purpose 6.76 The guidelines specify that, as a general rule, informed consent is required for each new purpose for which the biological sample is to be used. Accordingly, consent to the use of collected samples for unspecified future research is not acceptable. However, research ethics committees may sometimes depart from this general rule if the benefits of the knowledge to be gained are considered to clearly outweigh the threat to the integrity of the individual or group concerned. 411 Factors which may justify a departure from the general rule include: only coded information is to be used; the purpose and type of analysis in the new research project is very similar to the that which the subject has previously given an informed consent; or the size of the study means obtaining informed consent would be impossible. Deceased 6.77 Specific issues arise where the donor of the biological sample intended for use in new research has deceased. In particular, the guidelines advise research ethics committees to consider whether or not relatives of the deceased should be informed. If it is decided that relatives are to be informed, it is necessary to determine how they are to be contacted and informed and who should be responsible for this. 412 Code Keys 6.78 As well as considering issues related to the principle of informed consent, the MFR guidelines stipulate that research ethics committees must also determine the conditions under which code keys may be used to de-code the stored information that is to be used for research. 413 International Collaboration 6.79 The MFR guidelines state that in the case of international collaboration, only coded material may be sent abroad. In the case of Swedish research projects which propose to use 410 Research Ethics Guidelines, p Id. 412 Id. 413 Research Ethics Guidelines, p

106 tissue samples from foreign biobanks or donors, the research proposal must be reviewed by a Swedish research committee alongside any existing rules in each other country. Biobanks in Industry 6.80 All the above rules apply equally to biobanks maintained within industry, although the MFR states that such biobanks should only include coded material, and the code key should be stored with a suitable public authority such as a university or county council. 414 SUMMARY 6.81 Research is an area that is generally self-regulated by national health and medical research councils. 415 There is a general consensus as to the ethical requirements of research involving human beings and, specifically, human genetics research. All the policy statements provide that: informed consent is usually required; the consent requirement may be waived in certain circumstances; 416 where the research subject is incapable of consenting to participation, consent should be obtained from the subject s legal representative; an informed consent requires the individual to be provided with information regarding the purpose of the research, whether information obtained is to be coded, deidentified or identifiable, privacy protections, that the results of the research may be commercialised, the possible consequences of participating in the research, whether samples will be stored for future research purposes, and that participation is voluntary and consent may be withdrawn at any time; where the research is likely to produce results that relate to the individual s health status, appropriate genetic counselling should be available The key issue with regard to research into human genetics is not, therefore, what ethical standards should apply, but rather how these standards are applied in practice. On this issue, the position in the USA gives much cause for concern. A related issue is that the guidelines and policy statements tend to rely on vague terms such as minimal risk and the rights and welfare of the research subjects. 417 Official surveys conducted into ethical review boards in the USA reveal that not only are such terms applied variously, but that the volume of protocols received means that in some cases the review board spends just one or two minutes per protocol. Even more worryingly, the investigation revealed that several review boards had granted waivers of consent without finding and documenting the presence of the criteria that must be satisfied for consent to be waived In short, it is not sufficient to have ethical guidelines or codes of conduct governing human genetics research if these guidelines cannot be, or are not, enforced effectively. 414 Id. 415 Note, however, the Swedish Act Concerning Use of Gene Technology on Human Beings Generally, if the research entails minimal risk for the subjects, if the research purpose requires the requirement to be waived, and if the research will not adversely affect the rights and welfare of the individual. Or, in cases where the individual has consented to the use of their genetic data in an earlier research project, and the subsequent project is directly related to the earlier project. Or, if the research involves de-identified or coded data. 417 See, for example, the Research Council of Canada and the US Code of Federal Regulations. 103

107 ADOPTION USA 7.1 The issue of genetic testing in adoption is not new in the USA, although it appears to be the only country in which this issue has been specifically considered at any level. Policy statements regarding the use of genetic testing in adoption emanate primarily from the American Society of Human Genetics (ASHG), the first being published in 1986, and it is interesting to observe the changes in approach. American Society of Human Genetics: Report on Genetics and Adoption: Points to Consider 7.2 Towards the end of the 1980s, American health professionals and adoption agencies became increasingly aware of the importance of obtaining a genetic history as part of the adoption process. 418 Combined with recent changes in adoption laws and increasing knowledge of human genetics, the Social Issues Committee of the American Society of Human Genetics (ASHG) considered it an appropriate time to form a subcommittee to determine: whether genetic information should be collected on the adopted child and its biological parents and shared with the adoptive parents; whether the collection of such information should be required by law; and whether there was a need to develop genetic education programmes for social workers and other adoption agency staff During 1987, the subcommittee conducted two surveys looking at (i) state requirements for obtaining genetic information, and (ii) genetic information collected by adoption agencies. The surveys revealed that Wisconsin was the only state in which a statute explicitly mandated the collection of genetic information on children being placed for adoption. Under this legislation, in appropriate circumstances, adoptive parents and/or adopted persons should be provided with the medical and genetic history of the birth parents and any medical and genetic information furnished by the birth parents about the child s grandparents, aunts, uncles, brothers and sisters. 7.4 During 1988, the subcommittee sought opinions from the same agencies as to whether legislation should be mandated to collect such genetic information, and whether genetic education programmes should be implemented for adoption agency staff In 1990 the Social Issues Committee endorsed a statement regarding the importance of including a genetic history as part of the adoption process. A redrafted version of the statement was endorsed by the ASHG Board of Directors, who hoped that it would encourage state and private adoption agencies to collect helpful genetic histories. It was subsequently endorsed by the Alliance of Genetic Support Groups, and by the Council of Regional Networks for Genetic Services. 421 The statement provides that: every person should have the right to gain access to his or her medical record, including genetic data therein; 418 American Society of Human Genetics Social Issues Committee, Report on Genetics and Adoption: Points to Consider (1991), p Id. 420 Id. 421 Id., p

108 the compilation of an appropriate genetic history and the inclusion of genetic data in the adoptee s medical record should be a routine part of the adoption process; genetic information should be obtained and stored in a manner that provides for review, including periodic updating by appropriate individuals; when medically appropriate, genetic data may be shared with the adoptive parents, biological parents, and adoptees, although this should be done with the utmost respect for the right to privacy of the parties; the right to privacy includes the right of any party to refuse to enter into or cease to participate in the process of gathering genetic information. 422 ASHG/ACMG Report: Points to Consider: Ethical, Legal, and Psychosocial Implications of Genetic Testing in Children and Adolescents 7.6 In 1995, the American Society of Human Genetics (ASHG) and the American College of Medical Genetics (ACMG) issued a report, Points to Consider: Ethical, Legal and Psychosocial Implications of Genetic Testing in Children and Adolescents. 423 Among other things, the report stated that timely medical benefit to the child should be the primary justification for genetic testing in children and adolescents. 424 It also stated that if the medical or psychosocial benefits of a genetic test will not accrue until adulthood, as in the case of carrier status or adult onset diseases, genetic testing generally should be deferred The ASHG/ACMG statement is consistent with statements of other medical groups and organisations, including the American Medical Association, 426 the American Academy of Neurology, 427 and the American Society of Clinical Oncologists. 428 Moreover, the National Human Genome Research Institute s Task Force on Genetic Testing (the NHGRI Task Force) has expressly agreed with the ASHG/ACMG s position that timely benefit to the child should be the primary justification for testing. 429 ASHG/ACMG Joint Statement: Genetic Testing in Adoption 7.8 The most recent statement on genetic testing in adoption in the USA is the American Society of Human Genetics (ASHG) and the American College of Medical Genetics (ACMG) joint statement on genetic testing in adoption, issued in The statement was prompted by reports received from geneticists that prospective adoptive parents and adoption agencies are requesting an increasingly wide range of genetic tests before, during, or immediately after the adoption process The report considers the issue of genetic testing in adoption in terms of the interests of a number of parties: (1) the child; (2) the adoptive parents; (3) the biological parents; (4) 422 Id. 423 ASHG/ACMG Report, Points to Consider: Ethical, Legal, and Psychosocial Implications of Genetic Testing in Children and Adolescents (1995) (hereinafter, ASHG/ACMG Report). 424 ASHG/AGMG Report, p ASHG/ACMG Report, p Code of Ethics δ 2.138). 427 Practice Parameter: Genetic Testing Alert. 428 Genetic Testing for Cancer Susceptibility. 429 Joint Statement of the American Society of Human Genetics and the American College of Medical Genetics, Genetic Testing in Adoption (2000), p Joint Statement of the American Society of Human Genetics and the American College of Medical Genetics, Genetic Testing in Adoption (2000) (hereinafter Joint Statement) 431 Joint Statement, p

109 the adoption agency; and (5) the public at large. From the outset, the report emphasises that of these interests, the primary concern should be for the wellbeing of the child. 432 Child s Interests 7.10 The child s best interests are paramount in adoption proceedings, encompassing the child s physical and psychological health, privacy interests, and social development, all of which may be affected by genetic information. 433 The approach advocated in the ASHG/ACMG Joint Statement is that adopted children should be treated like biologically related children in terms of genetic testing. Requiring adopted newborns and children to undergo more extensive genetic testing than biologically related children turns adopted newborns and children into commodities. 434 Accordingly, the welfare of children affected by genetic conditions should be the first concern in the practice of medical genetics The Report also specifies that in assessing which genetic tests are appropriate for children, the nature of the test is a crucial consideration. 436 For this purpose, it is necessary to distinguish between the types of genetic test currently available, namely: (1) tests for preventable or treatable diseases; (2) tests for serious childhood diseases; (3) tests for adult-onset diseases for which no treatment or preventative action is available in childhood; (4) tests indicating a pre-disposition to a common adult-onset disorder for which some general preventative measures may be taken in childhood; (5) tests for behavioural traits; (6) tests for carrier status and other conditions that may impact on the child s future reproductive decisions; (7) tests that parents request without any direct relation to treatment or reproductive options of the child; and (8) tests performed solely for the benefit of another family member The ASHG and ACMG advise that only tests of type (1) and type (2) should be viewed with unqualified approval. An example of a type (1) test is newborn screening for phenylketonuria, 437 and a type (2) test should be supported when there is a health-related indication of the need to test, for example a child with a birth sibling who has already been diagnosed with cystic fibrosis As regards type (3) tests, for late onset conditions such as Huntington s disease and Alzheimer s disease, the Report recommends that the decision is best left to the individual at a time when s/he is mature enough to consider the potential ramifications of being tested. 439 Given that these conditions are serious untreatable diseases that do not become manifest until adulthood, and the fact that many adults with family histories of a genetic pre-disposition to such diseases chose not to be tested, this type of testing is generally not compatible with the child s best interests An example of tests within type (4) are those that screen for an increased risk of heart disease or skin cancer. The ASHG and ACMG advise that generally for tests such as 432 Joint Statement, p Id. 434 Joint Statement, p Joint Statement, p Joint Statement, p Such screening is frequently required by law. 438 Id. 439 Id. 440 Joint Statement, p

110 these, due to the potential for stigmatisation where individualised testing is conducted, a more population-orientated approach should be taken; numerous studies have shown that a majority of the population would benefit from a more healthy lifestyle. They recommend that because testing for genetic dispositions in newborns and children often lacks predictive value and is rarely justified, no special exception should be made for children in the adoption process Tests that attempt to screen for behavioural traits are also considered to be inappropriate due to the lack of predictive value and potential for stigmatisation. Note, however, that tests for genetic mutations that cause severe mental retardation, such as fragile X syndrome, would be considered as a type (2) test The sixth type of test, directed at a child s future reproductive decisions, includes carrier tests for autosomal recessive or X-linked disorders, such as cystic fibrosis or Duchenne muscular dystrophy. Again, such tests do not serve the immediate medical needs of the child and are not, therefore, appropriate in the adoption process Tests conducted solely at the request of the adoptive parents, which offer no medical or future reproductive benefit to the child (type (7)), cannot be justified. Similarly, type (8) tests, looking at the DNA of several members of a biological family to determine the likelihood of a single individual within a family having a gene mutation, lack justification in the adoption process The ASHG/ACMG statement also advises that caution must be exercised to avoid crafting an approach that is too broad in encouraging the collection of genetic information in the adoption process. 444 Adoptive Parents Interests 7.19 While the best interests of the child continue to form the legal benchmark of the adoption process in the USA, modern adoption laws also seek to protect the interests of the adoptive parents and the birth parents. 445 Moreover, the common law affords parents broad discretion to make medical decisions on behalf of their minor children. 446 Notwithstanding, the ASHG and ACMG assert that a distinction must be made between preventative and therapeutic medical decisions, and predictive genetic testing It has also been asserted that adoptive parents have the right to seek genetic testing of a child to enable them to make an informed decision on whether to adopt, taking account of emotional and financial considerations. 448 However, the ASHG/ACMG Report adopts the position that children do not come with guarantees, and whilst adoptive parents should be informed of known illnesses, predictive genetic testing goes well beyond this standard and is neither advisable nor necessary. 449 Birth Parents Interests 441 Id. 442 Id. 443 Id. 444 Id. 445 See R, W. Howe, Adoption practice, issues, and laws (1983) Fam. L.Q. 2: , cited in Joint Statement, p See M, Z. Pelias, Genetic Testing: who decides, who informs? Children s Legal Rights Jnl 19: 41-44, cited in Joint Statement, p Joint Statement, p Joint Statement, p Id. 107

111 7.21 The birth parents of an adopted child have an interest in privacy regarding their identification. This is reflected in the long tradition of keeping adoption records sealed. 450 This privacy interest is of even greater concern when sensitive genetic information is involved. At present, no US state requires genetic testing of birth parents The Report states that requiring either the child or the birth parents to undergo genetic testing as a condition of adoption thwarts their interest in privacy. Adoption Agencies Interests 7.23 The primary interests of the adoption agency are: (i) to place the child in its care with adoptive parents and to ensure the child remains with the adoptive parents; (ii) to protect the privacy of the child, the birth parents, and the adoptive parents; and (iii) to shield itself from potential liability. Accordingly, adoption agencies need clear guidance on the type of information they are required to disclose and the type of information they are required to hold in confidence The potential for liability means that adoption agencies may feel compelled to require genetic testing of the child and/or the birth parents. After all, in the USA, actions have been brought against adoption agencies for wrongful adoption based on the agencies negligence or fraud in placing children without adequately disclosing their medical or genetic history. 453 Indeed, courts in at least ten states have recognised actions for wrongful adoption. 454 In addition, US adoption agencies may be sued for failing to test the child for a genetic condition because, although adoption agencies are not required to, and ordinarily do not, conduct genetic tests, they are required to make reasonable inquiry into the child s medical history. 455 Accordingly, the mere threat of litigation may encourage some agencies to require genetic testing of adoptees without a clear understanding of their duties The ASHG/ACMG Report recommends that adoption agencies should only require adoptees to undergo genetic testing to the extent consistent with the child s best interests. Moreover, professional geneticists should be available to interpret family health information and appropriate genetic test results, in consultation with the adoption agency and the prospective adoptive parents. 456 Public Interest 7.26 The public interest lies in facilitating and encouraging adoptions. Thus, it is important that in attempting to protect the interests of the child, public policy should not restrict access to medical information to the extent that prospective parents chose to adopt overseas. Accordingly, professional guidelines and public policy must strike a balance to ensure the reasonable interests of all parties The ASHG and ACMG consider that these goals can best be achieved by limiting genetic testing of newborns and children in the adoption process to those performed on other children of a similar age. Such tests should also be intended to reveal only child-onset 450 See M, B. Blair, Lifting the genealogical veil: a blueprint for legislative reform of the disclosure of health-related information in adoption (1992) NC Law Rev 70: , cited in Joint Statement, p Joint Statement, p Joint Statement, p See M, B. Blair, The Uniform Adoption Act s Health Disclosure Provisions: A Model that Should Not Be Overlooked (1996) Fam. L.Q. 30: , cited in Joint Statement, p See L. Leshne, Wrongful Adoption: fewer secrets and lies, but agencies still fail at full disclosure (1999) Trial April, pp.14-17, cited in Joint Statement, p Joint Statement, p Id. 108

112 diseases, or disorders for which preventative measures or treatment may be undertaken in childhood. 457 SUMMARY 7.28 The issue of genetic testing in adoption has attracted the attention of the American Society of Human Genetics (ASHG) since the mid-1980s. The ASHG s early statements reflect the enthusiasm of the scientific world about the potential uses and benefits of the developing genetic testing technology. Thus, in its 1986 report, the ASHG considered whether the collection of genetic information concerning adopted children and their parents should be required by law However, as the potential risks of genetic testing (particularly genetic discrimination and stigmatisation) became more widely recognised, the ASHG modified its approach. Accordingly, more recent statements recognise the need to distinguish between the types of genetic tests currently available, and the purpose of such tests. The ASHG considers that only genetic testing for preventable or treatable diseases, and testing for serious childhood diseases, should be viewed with unqualified approval. As regards other types of genetic testing, such as for adult-onset diseases or carrier status, the ASHG recommends that such testing is inappropriate and cannot be justified The American Society of Human Genetics issued a joint statement with the American College of Medical Geneticists in The statement considers the issue of genetic testing in adoption in terms of the interests of a number of parties, including the adoptee, the adoptive parents, the biological parents, and the adoption agency. Notwithstanding the interests of other parties, the adoptees interests should always prevail. Moreover, the ASHG/ACMG joint statement advises that caution must be exercised to avoid crafting an approach that is too broad in encouraging the collection of genetic information in the adoption process, which arguably their earlier statements did. 457 Id. 109

113 INTERNATIONAL REGULATION HUGO Ethical, Legal, and Social Issues Committee: Statement on the Principled Conduct of Genetic Research 8.1 On 21 March 1996, the Council of the Human Genome Organisation (HUGO) approved guidelines produced by its Ethical, Legal and Social Issues Committee (HUGO- ELSI) regarding the principled conduct of genetics research The HUGO-ELSI recommendations are based on four fundamental principles: Recognition that the human genome is part of the common heritage of humanity; Adherence to international norms of human rights; Respect for the values, traditions, culture, and integrity of participants; and Acceptance and upholding of human dignity and freedom. HUGO-ELSI Recommendations 8.3 The first recommendation is that scientific competence is an essential pre-requisite for ethical research. It incorporates appropriate training, planning, pilot and field testing, as well as quality control through continual review of the research project. 8.4 The Committee makes several recommendations with regard to the recruitment of research participants. Firstly, undue inducement through compensation for individual participants, families, and populations should be prohibited. 459 Any communication with potential participants and their families must be both scientifically accurate and also understandable. Consultation should precede the recruitment process and continue throughout the research, taking account of the fact that cultural norms vary, as do perceptions of health, disease, disability and family. 8.5 Secondly, an understanding of the nature of the research, the potential risks and benefits, and any alternatives, is crucial for informed consent. The HUGO-ELSI also point out that informed decisions to consent to participate can be individual, familial, or at the level of communities and populations. Informed consent should always be free from coercion by scientific, medical, or other authorities. A possible exception to these consent requirements is recognised with regard to research involving anonymous testing for epidemiological and surveillance purposes, under certain circumstances and with proper authority. The recommendations also stipulate that any choices made by participants with regard to storage or other uses of any materials or information taken or derived therefrom be respected. Similarly, participants choices as to whether to be informed or not with regard to the research results or incidental findings should be respected. Such choices should also bind other researchers and laboratories. 8.6 The HUGO-ELSI guidelines also make recommendations with regard to the conduct and control of research. Firstly, the confidentiality of genetic information must be ensured by adequate privacy protections and safeguards to prevent unauthorised access. Specifically, procedures for authorised access and the transfer/conservation of samples and information should be developed and put into place before sampling begins. Any genetic 458 HUGO-ELSI, Statement on the Principled Conduct of Genetics Research, This prohibition does not, however, include agreements with individuals, families, groups, communities or populations that foresee technology transfer, local training, joint ventures, provision of health care or of information infrastructures, reimbursements of costs, or the possible use of a percentage of any royalties for humanitarian purposes. 110

114 information should be coded, and special consideration should always be given to the actual or potential interests of family members. 8.7 Secondly, the HUGO-ELSI state that collaboration between individuals, populations, and researchers, and the free flow, access to, and exchange of information, is essential to both scientific progress and also for the present and future benefit of all participants. However, an integrated approach and standardisation of conditions and consents is essential to ensure viable collaboration and comparisons of results. In particular, the HUGO-ELSI recommends that co-operation and co-ordination between industrialised and developing countries should be facilitated. Furthermore, any actual or potential conflict of interest must be revealed at the time information is communicated and before agreement is reached. Such actual or potential conflicts should also be reviewed by an ethical review committee before any research begins. 8.8 Finally, it is recommended that continual review and monitoring are essential for the implementation of the HUGO-ELSI guidelines. Where possible, such review should include representatives of participants in the research project. Like scientific competence, continual review is imperative to respecting human dignity in international collaborative genetic research. Indeed, the HUGO-ELSI warns that without continuing evaluation, the potential for exploitation, for duplicity, for abandonment, and for abuse by all cannot be ignored. HUGO Ethics Committee: Statement on DNA Sampling Control and Access 8.9 In February 1998, the HUGO Ethics Committee issued a statement on the control of, and access to, DNA samples in research. 460 In the introduction, the HUGO Ethics Committee reaffirms its commitment to its earlier Statement on the Principled Conduct of Genetic Research. 461 In particular it maintains that respect for free and informed consent and choice, as well as for privacy and confidentiality in the collection, storage and use of human DNA are the cornerstones of ethical conduct in research The statement addresses several ethical issues pertinent to sample collection and sharing in genetic research. Of primary importance is the source of the sample, that is, whether it was collected for medical/diagnostic purposes or during a specific research protocol, since this affects the ambit and the choices available in the consent process. Also of importance is the fact that by its very nature, genetic information is both personal and familial. Accordingly, the immediate or potential interests of family members cannot be ignored in the handling of the information provided and the choices offered. The shared biological risks of family members create special interests and moral obligations with respect to access, storage, and destruction that may occasionally outweigh individual wishes. However, this is not appropriate in relation to institutional third parties, such as employers, insurers and schools, because of the risk of discrimination The HUGO Ethics Committee considers that the most appropriate way to respect the privacy and confidentiality of individual research participants and their families is to avoid the transmission of identifiable samples wherever possible. The coding of samples is the preferred method, as anonymisation may preclude future research uses and the validation of results The Committee further recognises that the pursuit of scientific knowledge is essential to human progress and to the relief of human suffering, and that this pursuit must adhere to international norms of human rights. 460 HUGO Ethics Committee, Statement on DNA Sampling: Control and Access, See above, para

115 8.13 In light of these considerations, provided there is ethical review, the HUGO Ethics Committee makes the following recommendations. Recommendations 8.14 Firstly, the choices offered in the consent process should reflect the potential uses of the DNA sample and its information. Potential participants should be informed as to whether the sample and its information will be identifiable, coded or de-identified. The Committee recommends that whilst de-identification may be appropriate in certain research, caution should be exercised as it may preclude future research uses of the samples and validation of results With regard to routine samples obtained for health care purposes and stored, such samples may be used for research if: (i) there is general notification of such a policy; (ii) the patient has not yet objected; and, (iii) the sample to be used by the researcher has been coded or de-identified. The same conditions must be satisfied if research samples obtained with consent and stored are to be used for other research. In both cases, if the samples have been obtained and stored before notification of a general policy, they may be used provided the sample is coded or de-identified prior to use The Committee recommends that security mechanisms must be put into place to ensure that participants choices and desired levels of confidentiality are respected. However, special considerations should be made for access by immediate relatives. Where there is a high risk of having or transmitting a serious disorder which is preventable or treatable, immediate relatives should have access to stored DNA for the purpose of learning their own status. These exceptional circumstances should be made generally known at both the institutional level and in the research relationship Unless immediate relatives need to access the samples, stored samples may be destroyed at the specific request of the person from whom they derive. However, destruction is not possible for samples already provided to other researchers, or in the case of de-identified samples The Committee recommends that there should be no disclosure to institutional third parties of an individual s participation in a research project, nor of research results identifying individuals or families, except as authorised by law. As in the case of other medical information, there should be no disclosure without consent Finally, the HUGO Ethics Committee considers that international standardisation of the ethical requirements for the control and access of DNA samples and information is essential. UNESCO: Universal Declaration on the Human Genome and Human Rights 8.20 The UNESCO Declaration 462 was adopted in 1997, and the most notable amendment to earlier drafts was the inclusion of additional rights, particularly for persons who lack capacity to consent, 463 and those who do not wish to know the results of genetic tests. 464 Although a breach of the declaration would have little effect on a State, the declaration states that infringements are only permissible if prescribed by law, and if there are compelling reasons for them UNESCO, Universal Declaration on the Human Genome and Human Rights, 1997 (hereinafter UNESCO) 463 UNESCO, art.5(e). 464 UNESCO, art. 5(c). 465 UNESCO, art

116 Human Dignity and the Human Genome 8.21 Article 1 of the Declaration describes the human genome as the heritage of humanity. Accordingly, Article 4 provides that the human genome in its natural state shall not give rise to financial gain. Rights of the Persons Concerned 8.22 Article 5 specifies the rights of individuals with regard to research, treatment or diagnosis affecting their genome. Firstly, such research, treatment or diagnosis may only be undertaken after rigorous and prior assessment of the potential risks and benefits, and in accordance with any other requirement of national law In all cases, the free and informed consent of the relevant individual shall be obtained. If the individual is not able to give consent then consent must be obtained in the manner prescribed by law, guided by the person s best interests. 467 However, if a person does not have capacity to consent, research affecting his/her genome may only be carried out if: it is for his/her direct health benefit, subject to the authorisation and protective conditions prescribed by law; or it is undertaken by way of exception, with the utmost restraint, exposing the person to minimal risk and burden, and it is intended to benefit the health of other persons with the same genetic condition or in the same age category, subject to the conditions prescribed by law, and provided such research is compatible with the protection of the individual s human rights Article 5(c) provides that an individual has the right to decide whether or not to be informed of the results of genetic testing, and that this right must be respected. Article 5(d) stipulates that in the case of research, protocols must be submitted for prior review in accordance with relevant national and international research standards or guidelines Under article 6, no one must be subjected to discrimination based on genetic characteristics that is intended to infringe, or has the effect of infringing, human rights, fundamental freedoms and human dignity. Under article 7, any genetic data that relates to an identifiable individual that is stored or processed for any purpose must be held in confidence in accordance with the law The Declaration further provides that every person has the right, according to national and international law, to just reparation for any damage sustained as a direct result of an intervention affecting his or her genome Article 9 states that in order to protect human rights and fundamental freedoms, any limitations to the principles of consent and confidentiality may only be prescribed by law and for compelling reasons. 466 UNESCO, art.5(a). 467 UNESCO, art.5(b). 468 UNESCO, art.5(e). 469 UNESCO, art

117 Research on the Human Genome 8.28 Articles 10 to 12 contain provisions which relate specifically to research on the human genome. Article 10 provides that no research concerning the human genome should prevail over respect for human rights, fundamental freedoms and human dignity; and article 11 explicitly prohibits practices which are contrary to human dignity, such as reproductive cloning. Under article 12, benefits from advances in biology, genetics and medicine, concerning the human genome, shall be made available to all, and research concerning the human genome shall seek to offer relief from suffering and improve the health of individuals and humankind as a whole. Conditions for the Exercise Scientific Activity 8.29 The Declaration states that researchers responsibilities, including caution, intellectual honesty and integrity, require particular attention in the context of research on the human genome because of its ethical and social implications. 470 States should take appropriate measures to foster conditions favourable for freedom in the conduct of research on the human genome, having regard to the ethical, legal and social implications of such research, on the basis of the principles set out in the Declaration. 471 States should also recognise the value of promoting the establishment of independent, multidisciplinary and pluralist ethics committees to asses the ethical, legal and social implications raised by research on the human genome and its applications. 472 Solidarity and International Co-operation 8.30 The Declaration states that States should respect and promote the practice of solidarity towards individuals, families and population groups who are particularly vulnerable to, or affected by, genetic disease or disability. They should encourage research on the identification, prevention and treatment of both rare and endemic genetically based and genetically influenced diseases. 473 Article 18 further provides that States should continue to foster the international dissemination of scientific knowledge regarding the human genome, particularly between industrialised and developing countries Within the framework of international co-operation with developing countries, States should seek to encourage measures enabling: the risks and benefits of research on the human genome to be assessed, and abuse to be prevented; the capacity of developing countries to carry out research on human genetics, taking into consideration their specific problems; developing countries to benefit from the achievements of scientific and technological research so that their use in favour of economic and social progress can be to the benefit of all; the free exchange of scientific knowledge and information in the areas of genetics, biology and medicine to be promoted UNESCO, art UNESCO, art UNESCO, art UNESCO, art UNESCO, art

118 Promotion of the Principles in the Declaration 8.32 Articles 21 and 22 of the Declaration provide that States have a general duty to promote the principles set out in the Declaration through, inter alia, training, the conduct of research, and education, particularly of those responsible for science policies. Moreover, States should encourage other forms of research, training and information dissemination conducive to raising the awareness of society as a whole. Implementation of the Declaration 8.33 Article 22 stipulates that States should make every effort to promote the principles set out in the Declaration and to promote their implementation. The Declaration states that this can be done through education, training and information dissemination, to foster the recognition and effective application of the principles Finally, Article 25 of the Declaration stipulates that nothing in the Declaration may be interpreted as implying for any State, group or person any claim to engage in any activity or to perform any act contrary to human rights and fundamental freedoms, including the principles in the Declaration. European Convention on Human Rights and Biomedicine 8.35 The Convention for the Protection of Human Rights and Dignity of the Human Being with regard to the Application of Biology and Medicine: Convention on Human Rights and Biomedicine was adopted by the Committee of Ministers of the Council of Europe in November 1996 after five years negotiation. In Oviedo on 4 April 1997, 21 member states signed the Convention when it was formally opened for signature Article 1 of the Convention specifies the purpose and object of the Convention. It states that: Parties to this Convention shall protect the dignity and identity of all human beings, and guarantee everyone, without discrimination, respect for their integrity and other rights, and fundamental freedoms with regard to the application of biology and medicine Chapter IV of the Convention is devoted to the human genome. Article 12 states that: Tests which are predictive of genetic diseases or which serve either to identify the subject as a carrier of a gene responsible for a disease or to detect a genetic predisposition or susceptibility to a disease may be performed only for health purposes or for scientific research linked to health purposes, and subject to appropriate genetic counselling The restriction of genetic testing to health purposes and scientific research clearly has implications for those who would seek to use genetic testing for employment or insurance purposes. Indeed, the Explanatory Report accompanying the Convention states that, in accordance with article 12, it is forbidden to do predictive genetic testing as part of pre-employment medical examinations, whenever it does not serve a health purpose of the 475 UNESCO, art T. McGleenan, Genetic Testing and Screening: The Developing European Jurisprudence (1999) Human Reproduction and Genetic Ethics 5:1, p Convention on Human Rights and Biomedicine, Art.12 (emphasis added). 115

119 individual. 478 Similarly, genetic testing (that does not have a health purpose) should not be carried out as part of private insurance assessment because it entails a disproportionate interference in the rights of the individual to privacy However, the Convention does not explicitly prohibit insurers or employers from requiring individuals who have had a genetic test for health purposes to disclose the results of that test in connection with their application. At first glance, it might be thought that Article 11 of the Convention by implication prohibits the use of genetic test results by employers and insurers for assessment purposes. After all, Article 11 explicitly states that any form of discrimination against a person on grounds of his or her genetic heritage is prohibited. 480 However, a closer reading of the Convention reveals that this is not necessarily the case It must be remembered that the purpose of the Convention, stated in Article 1, is to guarantee everyone, without discrimination, respect for their integrity and other rights and fundamental freedoms. 481 Gaining employment or securing an insurance contract are not rights and fundamental freedoms within the meaning of the Convention. Accordingly, read in the context of Article 1, it would be misleading to construe Article 11 as prohibiting the use of genetic test results by employers and insurers in assessing applications. However, it should be understood that in the context of the Convention, discrimination refers to unjustified discrimination. Notwithstanding, the reiteration of Article 1 in Article 11 would seem to suggest that the spirit of the Convention is strongly opposed to unfair discrimination in the field of genetics As well as the Chapter on the human genome, the Convention also contains Chapters on consent and scientific research. As regards consent, Article 5 provides that any intervention in the health field may only be carried out after the person has given free and informed consent. Where the person does not have the capacity to consent, an intervention may only be carried out if it is for his/her direct benefit and with the authorisation of the person or body provided for by law. 482 There are two exceptions to this general rule, both of which are subject to strict conditions: (i) research, 483 and (ii) donation of regenerative tissue. 484 The particular importance of informed consent and the right not to know 485 in the context of genetic screening is emphasised in the Explanatory Report As regards scientific research, Chapter V provides that research on a human being may only be undertaken if: there is no alternative of comparable effectiveness to research on humans; the risks which may be incurred by that person are not disproportionate to the potential benefits of the research; the research project has been approved by the competent body after independent examination of its scientific merit and ethical acceptability; the persons undergoing research have been informed of their rights and the safeguards prescribed by law for their protection; and 478 Explanatory Report to the Convention on Human Rights and Biomedicine, p Id. 480 Note that the Explanatory Report makes clear that discrimination is intended to mean unfair discrimination : Explanatory Report to the Convention on Human Rights and Biomedicine, p Emphasis added. 482 Convention on Human Rights and Biomedicine, Art Convention on Human Rights and Biomedicine, Art.17, discussed below. 484 Convention on Human Rights and Biomedicine, Art Recognised in Art.10(2) of the Convention. 486 Explanatory Report to the Convention on Human Rights and Biomedicine, para

120 the necessary consent as provided for under Article 5 has been given expressly, specifically, and is documented. Such consent may be freely withdrawn at any time The Convention provides further protection for research on individuals who lack the capacity to consent. 488 Specifically, it must be impossible to carry out research of comparable effectiveness on individuals capable of giving consent; the results of the research must have the potential to provide real and direct benefit to the subject s health; the necessary authorisation provided for under Article 6 must have been given specifically and in writing; and the person concerned must not object. In exceptional circumstances, research that does not have the potential to produce results of direct benefit to the person concerned may be authorised if its aim is to significantly improve scientific understanding of the individual s condition, to the ultimate attainment of results capable of conferring benefit to the person concerned or to other persons in the same age group or afflicted with the same condition. 489 However, such research may only be authorised if it entails only minimal risk and minimal burden for the individual concerned. 490 European Data Protection 8.44 Data protection at a European level is guided by two key instruments: Data Protection Directive, (European Union) Recommendation N R (97) 5 on the Protection of Medical Data, 1997 (Committee of Ministers of the Council of Europe) 8.45 For a comprehensive historical survey of the protection of medical and genetic data in the European Union, see Frits W. Hondius, Protecting Medical and Genetic Data, European Journal of Health Law 4 (1997) World Medical Association: Declaration of Helsinki 8.46 The World Medical Association (WMA) Declaration of Helsinki was originally adopted by the 18 th World Medical Assembly in and has subsequently been revised. 492 The Declaration provides guidelines for medical doctors conducting biomedical research involving human subjects. Basic Principles 8.47 First and foremost, biomedical research involving human subjects must conform to generally accepted scientific principles 493 and should only be conducted by scientifically qualified persons. 494 In addition, the research protocol must be submitted for independent review in accordance with the laws and regulations of the country in which the research is to be conducted. 495 The protocol should always contain a statement on the ethical considerations involved and should indicate that the principles enunciated in the Declaration 487 Convention on Human Rights and Biomedicine, Art Convention on Human Rights and Biomedicine, Art Convention on Human Rights and Biomedicine, Art.17(2). 490 Id. 491 World Medical Association: Declaration of Helsinki: Recommendations Guiding Medical Doctors in Biomedical Research Involving Human Subjects (hereinafter Declaration of Helsinki). 492 Japan 1975, Italy 1983, Hong Kong 1989, South Africa 1996, Edinburgh Declaration of Helsinki, Part 1, principle Declaration of Helsinki, Part I, principle Declaration of Helsinki, Part I, principle

121 are complied with. 496 Furthermore, the importance of the objective must be proportionate to any inherent risk to the subject, 497 and the interests of the subject must always prevail over the interests of science and society The right of the research subject to safeguard his or her integrity must be respected and appropriate measures should be adopted to protect the subject s privacy. 499 Potential research subjects must also be informed of the aims, methods, anticipated benefits, and potential hazards of the study before consent is given. Moreover, potential participants must be informed that they are entitled to abstain from participation and that consent may be withdrawn at any time. The subject s free and informed consent should preferably be given in writing In the case of research subjects who lack the capacity to consent to participation, informed consent should be obtained from the legal guardian in accordance with national legislation. Where physical or mental incapacity makes it impossible to obtain informed consent, or when the subject is a minor, consent from the subject s legal representative replaces that of the subject in accordance with national law. 501 Non-Therapeutic Biomedical Research Involving Human Subjects 8.50 The Declaration also contains additional guidelines which apply to non-therapeutic bio-medical research involving human subjects. Firstly, in such cases, it is the duty of the physician to remain the protector of the life and health of that person. 502 Secondly, the subjects must be volunteers. 503 Thirdly, the research should be discontinued if in the judgement of the research team it may, if continued, be harmful to the individual. 504 Finally, the interest of science and society should never take precedence over the wellbeing of the subject. 505 World Medical Association: Declaration on the Human Genome Project 8.51 The World Medical Association (WMA) Declaration on the Human Genome Project was adopted by the 44 th World Medical Assembly in September Firstly, the WMA consider that information derived from the mapping of the human genes should be general property and should not be used for business aims. With regard to genetic information in the context of employment and insurance, the WMA advocates the same tacit consensus which prohibits the use of race discrimination in employment or insurance. 506 The WMA recognises the need for general ethical and legal guidelines to prevent discrimination and the genetic stigmatisation of the population at risk. The main criteria as regards research into the human genome are the evaluation of risk versus benefit, the respect of a person as a human being and the respect of autonomy and privacy. 507 The WMA also recognise the need for international information and transfer of technology and knowledge between all countries. 496 Declaration of Helsinki, Part I, principle Declaration of Helsinki, Part I, principle Declaration of Helsinki, Part I, principle Declaration of Helsinki, Part I, principle Declaration of Helsinki, Part I, principle Declaration of Helsinki, Part I, principle Declaration of Helsinki, Part III, principle Declaration of Helsinki, Part III, principle Declaration of Helsinki, Part III, principle Declaration of Helsinki, Part III, principle World Medical Association: Declaration on the Human Genome (1992), p World Medical Association: Declaration on the Human Genome (1992), p

122 World Health Organisation: Proposed International Guidelines on Ethical Issues in Medical Genetics and Genetic Services 8.53 In 1995, the World Health Organisation (WHO) Human Genetics Programme developed the draft document Guidelines on Ethical Issues in Medical Genetics and the Provision of Genetic Services. 508 The draft document formed the background information for a WHO meeting on Ethical Issues in Medical Genetics held in December The meeting resulted in the adoption of the following guidelines. 509 Genetic Screening and Testing 8.54 The proposed ethical guidelines state that genetic screening and testing should be voluntary, not mandatory. 510 The only exception to this general principle is newborn screening, which WHO recommend should be mandatory and free of charge if early diagnosis and treatment will benefit the child. In all cases, prior to genetic screening, the subject should be provided with adequate information about the purpose and possible outcomes of the screening or test. 511 Furthermore, results of genetic tests should be followed by genetic counselling The guidelines further stipulate that the results of genetic tests should not be disclosed to third parties such as employers, insurers, schools, etc, without the individual s consent. In rare cases where disclosure may be in the best interests of the individual or of public safety, the guidelines recommend that the health care provider works with the individual to help the person reach a decision. 512 Informed Consent 8.56 In the context of research, a valid informed consent process should include an explanation of: the experimental nature and purpose of the study; why the individual is invited to participate, and that participation is voluntary; the procedure involved; the discomforts and potential risks of the test to both the individual and their family; the uncertainty of the results of the test for prediction and accurate genetic counselling; the possible benefits to others and to science; the confidentiality of records identifying the research subject; the right of the individual to withdraw at any time; and the right of the individual and family to unrestricted health care, even if the individual withdraws. 513 (Presumably this means unrestricted health care in accordance with the national provision of health care in the relevant country). 508 Unofficial WHO document, WHO/HDP/GL/ETH/95.1, cited in WHO Proposed International Guidelines on Ethical Issues in Medical Genetics and Genetic Services (1997), p Note, the guidelines are not considered in full here; the guidelines also cover areas such as prenatal diagnosis and assisted reproduction, which are not relevant for present purposes. 510 WHO, Proposed International Guidelines on Ethical Issues in Medical Genetics and Genetic Services (1997) (hereinafter WHO), p Id. 512 Id. 513 WHO, p.13. The guidelines also contain requirements for informed consent applicable to clinical practice, which are not considered here. 119

123 Presymptomatic Testing 8.57 The guidelines propose that presymptomatic testing in the absence of therapeutic options should be available if the following conditions are met: the information derived from the test will be used to prevent harm to the person tested, or to the person s spouse, family, prospective children or others; the person is fully informed of the limitations of testing, including the possibility of uninformative results; the person (or the legally authorised representative) is mentally capable of giving consent; and testing is accompanied by appropriate genetic counselling. 514 Disclosure and Confidentiality 8.58 The guidelines recognise that the possibility of harm resulting from disclosure to institutional third parties requires utmost care to be taken to protect confidentiality. However, if genetic test results indicate genetic risks to the individual s relatives, the genetic service provider should encourage the individual to ask the relatives to seek genetic counselling. 515 According to WHO, if the individual refuses, particularly in cases where effective treatment or preventative measures are available, the counsellor may ethically make direct contact with the relatives, bearing in mind that the information provided should concern only their own genetic risk, not the genetic status nor the identity of the relative who refused to inform them The guidelines further provide that the wish of individuals and families not to know genetic information, including test results, should be respected, except in testing of newborn babies or children for treatable conditions. 517 Any test results not directly relevant to health, such as non-paternity, may be withheld if this appears to be necessary to protect the interests of a vulnerable third party or if prescribed by national law. 518 Banked DNA 8.60 WHO adopts the position that existing stored specimens or samples, such as those in university or hospital departments, or collections of blood spots, should not be subject to new rules for consent or re-contact that may be established in the future. 519 The guidelines recommend that the most efficient approach is to obtain a blanket informed consent allowing use of a sample for genetic research in general, including future as yet unspecified projects Furthermore, WHO proposes that blood relatives of the individual whose sample is banked should be entitled to access a sample for the purpose of learning their own genetic status, but not the donor s genetic status. Spouses may not have such a right of access without the donor s consent, but their concerns should nevertheless be considered Institutional third parties, on the other hand, should not have access to the banked DNA, except for forensic purposes or instances when the information is directly relevant to 514 WHO, p WHO, p Id. 517 Id. 518 Id. 519 WHO, p WHO, p

124 public safety. 521 Access should be granted to qualified researchers if identifying characteristics are removed, and DNA should be stored for as long as it could be of benefit to living or future relatives of the individual Id. 522 Id. 121

125 REFERENCES Legislation Act Concerning Use of Gene Technology on Human Beings 1991 (Sweden) Americans With Disabilities Act 1996 (USA) Bill C-54 (Canada) Bill S-10: an Act to Amend the National Defence Act, the DNA Identification Act and the Criminal Code (Canada) Code of Criminal Procedure (Germany) Code of Federal Regulations: Protection of Human Subjects (USA) Crimes Amendment (Forensic Procedures) Act 1998 (Australia) Criminal Code (Canada) Data Protection Directive (European Union) DNA Identification Act 1994 (USA) DNA Identification Act 1998 (Canada) Federal Data Protection Act 1990 (Germany) Genetic Privacy and Non-Discrimination Bill 1998 (Australia) Health Insurance Portability and Accountability Act 1996 (USA) Individual Medical Records Act 1985 (Sweden) Medical Checks Act 1997 (The Netherlands) Personal Data Protection Act 2000 (The Netherlands) Personal Information Protection and Electronic Documents Act 2000 (Canada) Privacy Amendment Bill 1998 (Australia) Privacy Amendment (Private Sector) Bill 2000 (Australia) Privacy Protection Act 1988 (Australia) Policy Statements American Society of Human Genetics, Report on Genetics and Adoption: points to consider (1986) American Society of Human Genetics and American College of Medical Geneticists, Genetic Testing in Adoption (2000) American Society of Human Genetics and American College of Medical Geneticists, Points to Consider: Ethical, Legal and Psychosocial Implications of Genetic testing in Children and Adolescents (1995) Australian Democrats, Genetic Privacy and Non-discrimination Bill: additional comments (1999) 122

126 Australian Health Ethics Committee, Guidelines for Genetic Registers and Associated Genetic Material (1999) Canadian College of Medical Geneticists, Policy Statement on DNA Banking (1991) Code of Federal Regulations: Protection of Human Subjects Draft LISA Policy on Genetic Testing: Underwriting and Genetic Testing (1997) European Convention on Human Rights and Biomedicine (1996) German Society of Human Genetics, Position Paper (1996) HUGO-ELSI, Statement on the Principled Conduct of Genetic Research (1996) HUGO Ethics Committee, Statement on DNA Sampling Control and Access (1998) Human Genetics Society of Australasia, Guidelines for Human DNA Banking (1990) Human Genetics Society of Australasia, Privacy Implications of Genetic Testing (1999) National Bioethics Advisory Committee, Research Involving Human Biological Materials: Ethical Issues and Policy Guidance (1999) National Health and Medical Research Council, Ethical Aspects of Human Genetic Testing: an information paper (2000) National Health and Medical Research Council, National Statement on Ethical Conduct in Research Involving Humans (1999) Natural Sciences and Engineering Research Council of Canada, Human Genetic Research Research Councils of Canada, Ethical Conduct for Research Involving Humans (1998) Senate Legal and Constitutional Legislation Committee (1999) Standing Senate Committee on Social Affairs, Science and Technology (1999) Swedish Insurance Federation, Voluntary Code Swedish Medical Research Council, Research Ethics Guidelines for Using Biobanks (1999) UNESCO Universal Declaration on the Human Genome and Human Rights (1999) World Health Organisation, Proposed International Guidelines on Ethical Issues in Medical Genetics and Genetic Services (1995) World Medical Association: Declaration of Helsinki (1996) World Medical Association: Declaration on the Human Genome Project (1992) Articles Blair MB (1992) Lifting the genealogical veil: a blueprint for legislative reform of the disclosure of health-related information in adoption NC Law Rev Blair MB (1996) The Uniform Adoption Act s Health Disclosure Provisions: A Model that Should Not Be Overlooked Fam. L.Q

127 Billings PR et al (1992) Discrimination as a consequence of genetic screening Am J Hum Genetics Carter PI (1999) Health Information Privacy: Can Congress Protect Confidential Medical Information in the Information Age William Mitchell L. Rev Davis HR & Mitrius JV (1996) Recent Legislation on Genetics and Insurance Jurimetrics fn.18. Harper PS (1997) Genetic Testing, Life Insurance and Adverse Selection Phil Trans R Soc Lond B Howe RW (1983) Adoption practice, issues, and laws Fam. L.Q Juengst ET (1999) I-DNA-fication, Personal Privacy, and Social Justice Chicago-Kent L. Rev Keays D (1999)The Legal Implications of Genetic Testing: Insurance, Employment and Privacy, Jnl. of Law and Med Kimmelman J (2000) The Promise and Perils of Criminal DNA Databanking Nature Biotechnology Pelias MZ Genetic Testing: who decides, who informs? Children s Legal Rights Jnl Reiter E (1999) The Department of Defence DNA Repository: Practical Analysis of the Government s Interest and the Potential for Genetic Discrimination Buffalo L. Rev Rothstein MA (1992) Genetic Discrimination in Employment and the Americans with Disabilities Act Houston Law Rev Schumacher RW (1999) Expanding New York s DNA Database: The Future of Law Enforcement Fordham Urban L.J. 26 Woodward B (1999) Challenges to Human Research Subject Protections in US Medical Research JAMA